--- title: You Won’t Hear About These, Even In Myths (Atlassian... description: A pre-authentication arbitrary file read vulnerability, CVE-2026-21589, affects nearly all versions of Atlassian's Data Center products including Bitbucket,... canonical: https://daily.dev/posts/you-won-t-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary--bhcgqk6kx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) | daily.dev og:description: A pre-authentication arbitrary file read vulnerability, CVE-2026-21589, affects nearly all versions of Atlassian's Data Center products including Bitbucket,... og:url: https://daily.dev/posts/you-won-t-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary--bhcgqk6kx og:image: https://api.daily.dev/og/posts/BhCgQK6kX.png og:image:alt: You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) **[watchTowr Labs](https://daily.dev/sources/watchtowr-labs)** · 11 min read · 0 upvotes · 0 comments ## Summary A pre-authentication arbitrary file read vulnerability, CVE-2026-21589, affects nearly all versions of Atlassian's Data Center products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Researchers at watchTowr Labs reverse-engineered the patch diff between vulnerable and fixed versions of the atlassian-plugins-webresource JAR, finding that a deprecated function uses double-colon (::) sequences that get unescaped into forward slashes, enabling path traversal despite sanitization attempts. By chaining this with a webresource plugin route that maps to a directory with a trailing slash, attackers can read arbitrary files within the Tomcat webroot, including WEB-INF/web.xml. When Atlassian Crowd is configured for identity management (as officially recommended), the WEB-INF/classes/crowd.properties file leaks plaintext Crowd application credentials, which can be used to directly access Crowd's REST API to create a new user and add them to the jira-administrators group, achieving full administrative takeover. Atlassian released an out-of-band advisory on October 5th with specific fixed versions for each product, and a detection tool has been published on GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-21589 and which Atlassian products does it affect? CVE-2026-21589 is a pre-authentication arbitrary file read vulnerability affecting nearly all previous versions of Atlassian Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It stems from a shared atlassian-plugins-webresource library where a deprecated function unescapes double-colon (::) sequences into slashes, enabling path traversal. Atlassian released an out-of-band advisory on October 5th with fixed versions for each product. _Teams running Atlassian Data Center products can track critical advisories like this one on daily.dev before attackers weaponize them._ ### How can path traversal in Atlassian's webresource plugin lead to full Jira administrator takeover? Reading WEB-INF/classes/crowd.properties via the file-read bug leaks plaintext Atlassian Crowd application credentials, since Atlassian's own documentation recommends storing Crowd integration in that exact file. Those credentials grant direct REST API access to Crowd's identity management, letting an attacker create a new user, add it to the jira-administrators group, and gain full administrative control, provided Crowd isn't IP-whitelisted. _Developers chaining low-severity disclosures into real exploits often follow research like this through daily.dev._ ### What path traversal payload exploits the Atlassian webresource double-colon unescaping bug? The exploit uses a sequence like ..::..::..::..::WEB-INF::web.xml sent to a webresource download route with a trailing-slash location, such as /download/resources/jira.webresources:color-picker-popup/images/. The server's unescapeSlashes function converts the double colons into forward slashes after path-traversal filtering has already run, allowing arbitrary file reads within the application server's webroot, including Jira's web.xml and Bitbucket's urlrewrite.xml. _Security engineers reverse-engineering patch diffs for real exploit primitives can follow writeups like this on daily.dev._ ## Similar posts on daily.dev - [Artifactory Vulnerabilities Under Active Exploitation Enable Authentication Bypass and Admin Access](https://daily.dev/posts/artifactory-vulnerabilities-under-active-exploitation-enable-authentication-bypass-and-admin-access-39gsdirjz) · InfoQ · 0 upvotes · 0 comments - [Exploited JFrog Artifactory bug puts software supply chain on alert](https://daily.dev/posts/exploited-jfrog-artifactory-bug-puts-software-supply-chain-on-alert-fl2nmmecb) · CSO Online · 2 upvotes · 0 comments - [Apache Tomcat Path Traversal Vulnerability \(CVE-2025-55752\) Notice](https://daily.dev/posts/apache-tomcat-path-traversal-vulnerability-cve-2025-55752-notice-ayc1yqf81) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#atlassian](https://daily.dev/tags/atlassian), [#jira](https://daily.dev/tags/jira) [View this post on daily.dev](https://daily.dev/posts/you-won-t-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary--bhcgqk6kx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)","url":"https://daily.dev/posts/you-won-t-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary--bhcgqk6kx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/you-won-t-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary--bhcgqk6kx"},"datePublished":"2026-10-06T17:04:58.928Z","dateModified":"2026-10-07T21:10:07.475Z","description":"A pre-authentication arbitrary file read vulnerability, CVE-2026-21589, affects nearly all versions of Atlassian's Data Center products including Bitbucket,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6febddd23467c8fa7403651fc84b6b52?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6febddd23467c8fa7403651fc84b6b52?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"watchTowr Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"watchTowr Labs","logo":"https://media.daily.dev/image/upload/s--6_x7BAvI--/f_auto,q_auto/v1774959933/logos/watchtowr-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/watchtowr-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/you-won-t-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary--bhcgqk6kx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability,atlassian,jira","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"watchTowr Labs","item":"https://daily.dev/sources/watchtowr-labs"},{"@type":"ListItem","position":3,"name":"You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/you-won-t-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary--bhcgqk6kx#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-21589 and which Atlassian products does it affect?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-21589 is a pre-authentication arbitrary file read vulnerability affecting nearly all previous versions of Atlassian Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It stems from a shared atlassian-plugins-webresource library where a deprecated function unescapes double-colon (::) sequences into slashes, enabling path traversal. Atlassian released an out-of-band advisory on October 5th with fixed versions for each product. Teams running Atlassian Data Center products can track critical advisories like this one on daily.dev before attackers weaponize them."}},{"@type":"Question","name":"How can path traversal in Atlassian's webresource plugin lead to full Jira administrator takeover?","acceptedAnswer":{"@type":"Answer","text":"Reading WEB-INF/classes/crowd.properties via the file-read bug leaks plaintext Atlassian Crowd application credentials, since Atlassian's own documentation recommends storing Crowd integration in that exact file. Those credentials grant direct REST API access to Crowd's identity management, letting an attacker create a new user, add it to the jira-administrators group, and gain full administrative control, provided Crowd isn't IP-whitelisted. Developers chaining low-severity disclosures into real exploits often follow research like this through daily.dev."}},{"@type":"Question","name":"What path traversal payload exploits the Atlassian webresource double-colon unescaping bug?","acceptedAnswer":{"@type":"Answer","text":"The exploit uses a sequence like ..::..::..::..::WEB-INF::web.xml sent to a webresource download route with a trailing-slash location, such as /download/resources/jira.webresources:color-picker-popup/images/. The server's unescapeSlashes function converts the double colons into forward slashes after path-traversal filtering has already run, allowing arbitrary file reads within the application server's webroot, including Jira's web.xml and Bitbucket's urlrewrite.xml. Security engineers reverse-engineering patch diffs for real exploit primitives can follow writeups like this on daily.dev."}}]} ```