Atlassian CVE-2026-21589: pre-auth file read in eight Data Center apps

CVE-2026-21589 is one bug in eight products. It sits in a shared Atlassian web-resource library, and Atlassian lists eight Data Center products as affected, Jira, Confluence and Bitbucket among them. Without logging in, anyone who knows a file's exact path can read it from the application's web root. A file read sounds modest until you remember what lives in a Java web root: configuration, and sometimes credentials.

Atlassian published the advisory and fixes on 5 October 2026, saying it had found no exploitation in Cloud. watchTowr published a patch analysis the next day, and that evening a threat intelligence firm reported exploitation attempts against its honeypots. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 15 October, with an 18 October deadline.

Who is affected

Every version of these self-managed products before the fixed releases. Upgrade to the fixed version on your line, or later:

Atlassian Cloud is already patched and needs no action. Atlassian's advisory names Data Center editions and does not address end-of-life Server installs separately; treat any remaining Server install as exposed.

Any instance an attacker can reach over HTTP is exposed. The bug cannot list directories, so the attacker has to guess exact file paths, but standard file locations in a known product are easy to guess.

How CVE-2026-21589 works

The flaw is in the shared atlassian-plugins-webresource library; watchTowr compared vulnerable version 6.0.7 with fixed 6.0.8. The library's router encodes / as :: inside resource URLs and decodes it again later. On the routes that serve resources, user-supplied paths go through that decoding step, so ..:: becomes ../, a directory traversal. The decoded path then reaches code that loads files from disk, and an existing path filter does not stop it.

Reads stay inside the Tomcat web application, but that includes WEB-INF, where configuration lives. In watchTowr's lab, WEB-INF/classes/crowd.properties gave up the Crowd application name, its password in plain text and the Crowd URL. With those, watchTowr used Crowd's REST API to create a user and add it to jira-administrators. Crowd's per-application IP allow-list can block that step.

Atlassian scores the bug 9.3 under CVSS 4.0, rating confidentiality impact high on the product and all impacts high on other systems. NVD scores it 7.5 under CVSS 3.1. CISA assigned CWE-552, files accessible to external parties; Atlassian lists no CWE. Atlassian does not say who reported the bug; watchTowr worked from the patch.

Is it being exploited?

CISA says yes: it listed the CVE in KEV on 15 October 2026 with an 18 October due date and marked forensic triage as required under BOD 26-04. Ransomware use is listed as unknown.

The public evidence describes attempts, not breaches:

• Atlassian found no exploitation in Cloud and says it cannot confirm whether customer instances were affected.
• Previdian, a threat intelligence firm, reported attempts hitting its honeypots on 6 October and shared attacker IPs, according to Help Net Security.
• Rapid7 notes that file-read proof-of-concept scripts and a Nuclei template are public.

No threat actor or confirmed compromise has been publicly described.

Check your exposure

Confirm versions, then search access logs the way Atlassian describes:

# Jira and Bitbucket report their version over REST.
curl -s https://jira.example.com/rest/api/2/serverInfo
curl -s https://bitbucket.example.com/rest/api/1.0/application-properties
 
# Approximates Atlassian's check: decode each request line up to twice,
# then flag ".." next to /, \ or ::. Use the advisory's regex as the reference.
python3 - access_log.txt <<'EOF'
import re, sys
from urllib.parse import unquote
pat = re.compile(r"\.\.(/|\\|::)|(/|\\|::)\.\.")
for line in open(sys.argv[1], errors="replace"):
    once = unquote(line)
    if pat.search(line) or pat.search(once) or pat.search(unquote(once)):
        print(line, end="")
EOF

For the other products, the version appears on the administration System Information page.

Fix it

Upgrade each product to its fixed release. Atlassian no longer ships binary patches, so the fix is a version upgrade; critical fixes are backported to maintenance releases.

Until you can upgrade, Atlassian offers interim mitigations:

• Restrict access. Remove the instance from the internet or limit who can reach it.
• WAF or proxy rule (all affected products). Block requests with .. next to /, \ or ::, including URL-encoded forms, and test the rule against those patterns.
• Tomcat rewrite (Jira, Jira Service Management, Confluence, Bamboo, Crowd). Back up, then on each node enable Tomcat's RewriteValve in server.xml, add Atlassian's rewrite.config rules under WEB-INF and restart.
• Bitbucket. Add Atlassian's rule at the top of urlrewrite.xml so matching requests get a 404, then restart.

Copy the rules from the advisory itself. If logs show hits, rotate any secret that sat in a readable file, starting with the Crowd application password.

Detect attempts and compromise

• Access logs. Atlassian's method: URL-decode each request line up to two times and look for .. next to /, \ or ::, or run its regex over raw lines.
• Vulnerability checks. watchTowr's detection artefact generator tests Jira, Confluence and Bitbucket. Rapid7 has unauthenticated checks for Jira Software Data Center only.
• WAF alerts. Akamai ships rule 3000990 for this file read.
• Crowd and admin changes. New users or new jira-administrators members you cannot explain, given the chain watchTowr demonstrated.

No IOCs have been published. If logs show successful reads before you patched, treat what those files held as disclosed and bring in your security team, as Atlassian advises.

Beyond this patch

Shared libraries spread one bug across a product family, and a file read becomes account takeover the moment a readable file holds a credential. Keep secrets out of web roots where you can, and restrict which addresses integration accounts accept. How Rokkhe validates a finding covers telling a reachable bug from a version match.