--- title: CVE-2026-21589: Critical unauthenticated arbitrary file... description: Atlassian published a security advisory on October 5, 2026 for CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability (CVSSv4 9.3)... canonical: https://daily.dev/posts/cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products-lb31gqarn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products | daily.dev og:description: Atlassian published a security advisory on October 5, 2026 for CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability (CVSSv4 9.3)... og:url: https://daily.dev/posts/cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products-lb31gqarn og:image: https://api.daily.dev/og/posts/lb31GQARN.png og:image:alt: CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 3 min read · 0 upvotes · 0 comments ## Summary Atlassian published a security advisory on October 5, 2026 for CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability (CVSSv4 9.3) affecting Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd Data Center, Crucible, and Fisheye. An attacker who knows a file's exact path can read it from the web root without authentication, though no directory listing or enumeration is possible. watchTowr Labs' technical analysis traced the root cause to double-colon (::) sequences being treated as path separators, enabling path traversal into Atlassian's web-resource handling code. In a tested scenario, reading crowd.properties exposed credentials usable to create an admin account. Fixed versions are listed for each product, and Atlassian provides WAF rules, RewriteValve, and urlrewrite.xml mitigations for organizations unable to patch immediately. Rapid7 recommends emergency patching, log review using provided regex patterns, and credential rotation if compromise is suspected. Public PoC exploit scripts and a Nuclei detection template are already available. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-21589 and which Atlassian products does it affect? CVE-2026-21589 is a critical unauthenticated arbitrary file access vulnerability with a CVSSv4 score of 9.3, affecting Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. An attacker who knows a target file's exact name and path can read it from the web root without authentication, though directory listing is not possible. Atlassian published the advisory on October 5, 2026. _Teams running Atlassian Data Center products can track critical CVE disclosures like this one on daily.dev._ ### What fixed version of Jira Software Data Center patches CVE-2026-21589? Jira Software Data Center is fixed in versions 9.12.40, 10.3.26, and 11.3.12. Other affected products have their own fixed versions: Bitbucket Data Center 9.4.26/10.2.8/10.5.1, Confluence Data Center 9.2.26/10.2.19, Jira Service Management Data Center 5.12.40/10.3.26/11.3.12, Bamboo Data Center 10.2.24/12.1.12, Crowd Data Center 6.3.7/7.0.3/7.1.7/7.2.4, and Crucible/Fisheye 4.9.15. _Patching across multiple Atlassian products at once gets easier when upgrade details are tracked in one place on daily.dev._ ### How does the CVE-2026-21589 path traversal exploit work technically? The vulnerability stems from Atlassian's web-resource handling treating double-colon (::) sequences as path separators during request processing, letting traversal components reach the resource-loading code and read back arbitrary file contents. Testing by watchTowr Labs could not escape the Tomcat context but could read any file within the application web root; reading a Crowd configuration file exposed credentials that could be used to create a Jira admin account. _Understanding exploit mechanics like this helps defenders write better detections, a workflow daily.dev supports for security researchers._ ## Similar posts on daily.dev - [CVE-2026-82329: Unauthenticated Administrative Access in…](https://daily.dev/posts/cve-2026-82329-unauthenticated-administrative-access-in--jp5ers0bt) · Sliver C2 Documentation · 0 upvotes · 0 comments - [Exploited JFrog Artifactory bug puts software supply chain on alert](https://daily.dev/posts/exploited-jfrog-artifactory-bug-puts-software-supply-chain-on-alert-fl2nmmecb) · CSO Online · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#atlassian](https://daily.dev/tags/atlassian), [#jira](https://daily.dev/tags/jira) [View this post on daily.dev](https://daily.dev/posts/cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products-lb31gqarn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products","url":"https://daily.dev/posts/cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products-lb31gqarn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products-lb31gqarn"},"datePublished":"2026-10-07T12:17:21.667Z","dateModified":"2026-10-07T21:10:07.475Z","description":"Atlassian published a security advisory on October 5, 2026 for CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability (CVSSv4 9.3)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products-lb31gqarn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,atlassian,jira","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products-lb31gqarn#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-21589 and which Atlassian products does it affect?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-21589 is a critical unauthenticated arbitrary file access vulnerability with a CVSSv4 score of 9.3, affecting Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. An attacker who knows a target file's exact name and path can read it from the web root without authentication, though directory listing is not possible. Atlassian published the advisory on October 5, 2026. Teams running Atlassian Data Center products can track critical CVE disclosures like this one on daily.dev."}},{"@type":"Question","name":"What fixed version of Jira Software Data Center patches CVE-2026-21589?","acceptedAnswer":{"@type":"Answer","text":"Jira Software Data Center is fixed in versions 9.12.40, 10.3.26, and 11.3.12. Other affected products have their own fixed versions: Bitbucket Data Center 9.4.26/10.2.8/10.5.1, Confluence Data Center 9.2.26/10.2.19, Jira Service Management Data Center 5.12.40/10.3.26/11.3.12, Bamboo Data Center 10.2.24/12.1.12, Crowd Data Center 6.3.7/7.0.3/7.1.7/7.2.4, and Crucible/Fisheye 4.9.15. Patching across multiple Atlassian products at once gets easier when upgrade details are tracked in one place on daily.dev."}},{"@type":"Question","name":"How does the CVE-2026-21589 path traversal exploit work technically?","acceptedAnswer":{"@type":"Answer","text":"The vulnerability stems from Atlassian's web-resource handling treating double-colon (::) sequences as path separators during request processing, letting traversal components reach the resource-loading code and read back arbitrary file contents. Testing by watchTowr Labs could not escape the Tomcat context but could read any file within the application web root; reading a Crowd configuration file exposed credentials that could be used to create a Jira admin account. Understanding exploit mechanics like this helps defenders write better detections, a workflow daily.dev supports for security researchers."}}]} ```