Atlassian CVE-2026-21589: one unauthenticated request reads the file that trusts everyone

On October 5, 2026, Atlassian published patches for an arbitrary file access vulnerability that affects eight of its self-hosted Data Center products at once. The advisory is short, the exploit path is short, and the reason it matters is the file an attacker can reach with it.
The flaw is CVE-2026-21589, rated 9.3 under CVSS v4.0. It allows an unauthenticated remote attacker to read files under the web application root of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye. Atlassian states that the attacker must already know the exact name and relative path of the target file, and cannot enumerate directory contents. That constraint is real, but it is a smaller obstacle than it sounds, because the interesting filenames in these products are documented.

The mechanism

The vulnerable code lives in a shared library, atlassian-plugins-webresource. The webresource router performs a second URL decode on the request path, then converts the double-colon sequence :: back into a forward slash, then hands the result to the file resolver. Tomcat normalises the URI before that point, so the traversal segments survive normalisation and are reconstructed afterwards. The result is a path traversal that skips the check the servlet container already performed.
watchTowr Labs published a technical analysis and a detection tool on October 6, 2026, after diffing patched and unpatched builds. The published example target is the WEB-INF directory, which normally is not reachable from the web tier. A representative unauthenticated request form looks like this:

GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml

A request of this shape returned web.xml on the Jira test instance in the research write-up. Equivalent paths were confirmed for Confluence and Bitbucket, which is consistent with a defect in a component the whole product family shares. The traversal cannot escape the Tomcat application context, so this is not a general filesystem read. It is a read of the application directory, which happens to hold credentials.

Why the file read is the whole problem

In a Jira deployment that integrates with Crowd for single sign-on, the connection parameters live in WEB-INF/classes/crowd.properties. Those parameters include the Crowd application name, the Crowd application password and the Crowd server address, stored in plaintext in some configurations. An attacker who reads that file holds the shared secret Jira uses to authenticate to the identity platform. With it, the attacker can call the Crowd API, create an administrator account, and then log into Jira as that account. The information disclosure becomes account takeover without a second vulnerability.
That chain is why the severity is 9.3 rather than a moderate information-disclosure score. The read is limited, but the content it targets is authentication material for the wider platform.

Detection and response

The immediate action is to patch. Atlassian lists fixed versions per product, including Bitbucket Data Center 9.4.26, 10.2.8 and 10.5.1; Confluence Data Center 9.2.26 and 10.2.19; Jira Software Data Center 9.12.40, 10.3.26 and 11.3.12; Jira Service Management Data Center 5.12.40, 10.3.26 and 11.3.12; Bamboo Data Center 10.2.24 and 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7 and 7.2.4; and Crucible and Fisheye 4.9.15.
Where patching cannot happen immediately, Atlassian recommends taking the instance off the public internet and adding a WAF rule that blocks requests containing .. sequences, including URL-encoded variants such as %2e%2e and double-encoded forms.
Two detection tasks follow from the mechanism. First, search web access logs for requests containing ..::, %2e%2e, or double-colon sequences in resource download paths. Second, because the Crowd path is the highest-value chain, rotate the Crowd application password for any instance that was exposed during the window and audit the Crowd administrator group for accounts that were not created by a known operator. Previdian reported 15 exploitation attempts from three source IPs in Japan and the United States within hours of the technical details going public, so scanning activity against exposed instances is already occurring.
The broader lesson is about shared components. One router in one library carried the defect into eight products with eight different patch cadences. An inventory that tracks Atlassian products as separate systems will understate how quickly the whole estate moves when that shared layer fails.

References

• Atlassian security advisory for CVE-2026-21589, Arbitrary File Access Vulnerability impacting multiple products.
• watchTowr Labs technical analysis and detection tool for CVE-2026-21589.
• Qi An Xin CERT advisory QVD-2026-75562 for CVE-2026-21589.
• Previdian exploitation telemetry reported through security news coverage, October 2026.