--- title: CVE-2026-21589: pre-auth file read in Atlassian Data... description: Atlassian issued an out-of-band advisory for CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file read vulnerability affecting Data Center... canonical: https://daily.dev/posts/cve-2026-21589-pre-auth-file-read-in-atlassian-data-center-products-ydrtwmzce twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CVE-2026-21589: pre-auth file read in Atlassian Data Center products | daily.dev og:description: Atlassian issued an out-of-band advisory for CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file read vulnerability affecting Data Center... og:url: https://daily.dev/posts/cve-2026-21589-pre-auth-file-read-in-atlassian-data-center-products-ydrtwmzce og:image: https://api.daily.dev/og/posts/YDrTWMZCE.png og:image:alt: CVE-2026-21589: pre-auth file read in Atlassian Data Center products og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CVE-2026-21589: pre-auth file read in Atlassian Data Center products **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary Atlassian issued an out-of-band advisory for CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file read vulnerability affecting Data Center versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. watchTowr Labs found that a deprecated function in the atlassian-plugins-webresource JAR mishandles double-colon sequences as escaped slashes, enabling path traversal despite input sanitization, chained with a webresource plugin route to read files like WEB-INF/web.xml. If Crowd is used for identity management, the exposed crowd.properties file leaks plaintext credentials that attackers can use via the Crowd REST API to create a new user, add it to jira-administrators, and gain full admin control. Cloud customers are unaffected since the SaaS offering was already patched. Atlassian released fixed versions on October 5th and urges immediate patching or taking affected instances offline; a detection tool is available on GitHub. ## Content Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access flaw (CVSS 9.3) in the self-hosted Data Center versions of eight products: Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira Service Management and Jira Software. The advisory came out on October 5. Atlassian's cloud offerings were already patched, and the company says it has found no evidence of exploitation there. ## What the flaw allows An unauthenticated attacker can read files inside the web application root. No login or user interaction is needed. There is one real limit: the attacker has to know the exact file name and path, because directory listing and enumeration aren't possible. That limit doesn't help much. Config files sit at well-known locations, and a single readable secret can open the door to something much bigger. These products hold source code, identity management and internal documentation. ## Root cause watchTowr Labs diffed the vulnerable and fixed versions of the atlassian-plugins-webresource JAR. A deprecated function treats double-colon (::) sequences as path separators and unescapes them into forward slashes, so traversal gets through despite the sanitization. Chained with a webresource plugin route that maps to a directory with a trailing slash, this lets an attacker read anything under the Tomcat webroot, including WEB-INF/web.xml. ## How it escalates When Crowd is set up for identity management, which Atlassian officially recommends, WEB-INF/classes/crowd.properties holds plaintext Crowd application credentials. watchTowr used them to call Crowd's REST API, create a new user and add it to the jira-administrators group. That is full administrative takeover, and in a Crowd SSO environment it can mean compromise of the whole Atlassian estate. ## Exploit status Some reports say no public exploit or in-the-wild exploitation has been seen. Others point out that public PoC scripts and a Nuclei detection template are already available, along with a detection tool on GitHub. Assume attackers have what they need. ## What to do - **Patch.** Atlassian lists fixed versions for each product. It no longer ships binary patches, so this means upgrading to a new maintenance release, not applying a quick fix. - **If you can't patch yet,** restrict network access or take affected instances off the public internet. Atlassian also offers WAF rules, Tomcat RewriteValve rules and urlrewrite.xml changes, to be applied on every cluster node. It stresses these are not substitutes for patching. - **Check your logs.** Search access logs for traversal patterns. Rapid7 provides regex patterns for this. - **Rotate credentials** if you suspect exposure, starting with anything in crowd.properties and other config files. The flaw also fits Atlassian's longer push to move customers off Data Center software and onto its cloud. ## Questions this post answers ### What is CVE-2026-21589 and which Atlassian products does it affect? CVE-2026-21589 is a critical (CVSS 9.3) unauthenticated arbitrary file read vulnerability affecting the Data Center versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An attacker who knows the exact filename and path can read files within the web application root without authentication, though directory listing is not possible. Atlassian released fixed versions and an out-of-band advisory on October 5th. _Teams running Atlassian Data Center track critical CVEs like this one on daily.dev to patch before exposure._ ### How does the Atlassian webresource path traversal bug actually work technically? A deprecated function in the atlassian-plugins-webresource JAR treats double-colon (::) sequences as escaped forward slashes and unescapes them, defeating input sanitization meant to block path traversal. Researchers at watchTowr Labs chained this flaw with a webresource plugin route that maps to a directory with a trailing slash, letting an attacker read arbitrary files in the Tomcat webroot, including WEB-INF/web.xml. _Developers researching path traversal root causes can follow writeups like this on daily.dev._ ### How can a file read vulnerability in Atlassian products lead to full admin takeover? If Atlassian Crowd is configured for identity management, the exposed WEB-INF/classes/crowd.properties file contains Crowd application credentials in plaintext. An attacker who reads this file via the path traversal flaw can use those credentials against Crowd's REST API to create a new user and add it to the jira-administrators group, granting full administrative control over the instance. _Admins assessing blast radius from credential leaks follow escalation chains like this on daily.dev._ ## Similar posts on daily.dev - [Apache Tomcat Path Traversal Vulnerability \(CVE-2025-55752\) Notice](https://daily.dev/posts/apache-tomcat-path-traversal-vulnerability-cve-2025-55752-notice-ayc1yqf81) · Security Boulevard · 0 upvotes · 0 comments - [CVE-2026-82329: Unauthenticated Administrative Access in…](https://daily.dev/posts/cve-2026-82329-unauthenticated-administrative-access-in--jp5ers0bt) · Sliver C2 Documentation · 0 upvotes · 0 comments - [Artifactory Vulnerabilities Under Active Exploitation Enable Authentication Bypass and Admin Access](https://daily.dev/posts/artifactory-vulnerabilities-under-active-exploitation-enable-authentication-bypass-and-admin-access-39gsdirjz) · InfoQ · 0 upvotes · 0 comments --- Tags: [#tech-news](https://daily.dev/tags/tech-news), [#security](https://daily.dev/tags/security), [#atlassian](https://daily.dev/tags/atlassian), [#jira](https://daily.dev/tags/jira) [View this post on daily.dev](https://daily.dev/posts/cve-2026-21589-pre-auth-file-read-in-atlassian-data-center-products-ydrtwmzce) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CVE-2026-21589: pre-auth file read in Atlassian Data Center products","url":"https://daily.dev/posts/cve-2026-21589-pre-auth-file-read-in-atlassian-data-center-products-ydrtwmzce","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2026-21589-pre-auth-file-read-in-atlassian-data-center-products-ydrtwmzce"},"datePublished":"2026-10-06T17:07:00.031Z","dateModified":"2026-10-07T21:10:22.502Z","description":"Atlassian issued an out-of-band advisory for CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file read vulnerability affecting Data Center...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6febddd23467c8fa7403651fc84b6b52?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6febddd23467c8fa7403651fc84b6b52?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2026-21589-pre-auth-file-read-in-atlassian-data-center-products-ydrtwmzce","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"tech-news,security,atlassian,jira","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"CVE-2026-21589: pre-auth file read in Atlassian Data Center products"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cve-2026-21589-pre-auth-file-read-in-atlassian-data-center-products-ydrtwmzce#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-21589 and which Atlassian products does it affect?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-21589 is a critical (CVSS 9.3) unauthenticated arbitrary file read vulnerability affecting the Data Center versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An attacker who knows the exact filename and path can read files within the web application root without authentication, though directory listing is not possible. Atlassian released fixed versions and an out-of-band advisory on October 5th. Teams running Atlassian Data Center track critical CVEs like this one on daily.dev to patch before exposure."}},{"@type":"Question","name":"How does the Atlassian webresource path traversal bug actually work technically?","acceptedAnswer":{"@type":"Answer","text":"A deprecated function in the atlassian-plugins-webresource JAR treats double-colon (::) sequences as escaped forward slashes and unescapes them, defeating input sanitization meant to block path traversal. Researchers at watchTowr Labs chained this flaw with a webresource plugin route that maps to a directory with a trailing slash, letting an attacker read arbitrary files in the Tomcat webroot, including WEB-INF/web.xml. Developers researching path traversal root causes can follow writeups like this on daily.dev."}},{"@type":"Question","name":"How can a file read vulnerability in Atlassian products lead to full admin takeover?","acceptedAnswer":{"@type":"Answer","text":"If Atlassian Crowd is configured for identity management, the exposed WEB-INF/classes/crowd.properties file contains Crowd application credentials in plaintext. An attacker who reads this file via the path traversal flaw can use those credentials against Crowd's REST API to create a new user and add it to the jira-administrators group, granting full administrative control over the instance. Admins assessing blast radius from credential leaks follow escalation chains like this on daily.dev."}}]} ```