Critical Atlassian File-Access Flaw Affects Eight Products; Patches Available
Summary
CVE-2026-21589 lets unauthenticated attackers read files in the web root of eight Atlassian products. Public PoCs are available; Rapid7 urges emergency patching, log review, and credential rotation if protected files were accessed.
Key points
- Atlassian assigned CVE-2026-21589 a CVSSv4 score of 9.3; it affects eight Data Center or server products, including Jira, Confluence, Bitbucket, and Crowd.
- Attackers need the exact target file name and path; the flaw does not enable directory listing or enumeration.
- The path traversal uses double-colon sequences in web-resource handling to read arbitrary files within the application web root.
- In a tested Crowd deployment configured with Jira, reading crowd.properties exposed credentials that could be used to create a user and add it to jira-administrators; Crowd IP allowlisting can block this route.
- Public technical analysis and file-read proof-of-concept scripts are available. Rapid7 recommends upgrading to Atlassian's listed fixed versions or the latest version.
- If immediate patching is not possible, restrict external access and apply the vendor's limited WAF, proxy, or product-specific rewrite-rule mitigations; these do not replace patching.
- Review access logs for traversal attempts, including URL-decoded requests. If protected configuration files were accessed, contain affected systems and rotate exposed credentials and secrets. Atlassian Cloud products are already patched.
Article Details
- Vulnerability Types
- Arbitrary file access
- Path traversal
- Severity
- Critical; CVSSv4 9.3
- Affected Versions
- All versions before the applicable fixed release, including unsupported versions, of Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Remove affected instances from the internet or otherwise restrict external network access.
- Apply Atlassian's Web Application Firewall or proxy rule for affected products.
- Apply the Tomcat RewriteValve mitigation for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd.
- Apply the urlrewrite.xml rule for Bitbucket.
MITRE ATT&CK
T1005 · Data from Local SystemThe vulnerability allows an attacker to read arbitrary files within the application's web root, including protected configuration files.T1078 · Valid AccountsIn a tested Crowd deployment configured with Jira, credentials read from crowd.properties were used to create a user and add it to jira-administrators.T1190 · Exploit Public-Facing ApplicationThe unauthenticated remote attacker exploits CVE-2026-21589 in exposed Atlassian products.
CVE
Vendors
Products
Bamboo Data CenterCenter, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score ofBitbucket Data Centerfor CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, BambooConfluence Data Centera critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd DataCrowd Data CenterData Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3. AnCrucibleJira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3. An unauthenticated remoteExposure CommandExposure Command, Vulnerability Management, and NexposeFisheyeManagement Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3. An unauthenticated remote attacker who knowsJira Service Management Data Centervulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye.Jira Software Data Centerproducts: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned theNexposeExposure Command, Vulnerability Management, and NexposeTomcatTheir testing could not traverse outside the Tomcat context, but could read files throughout the application web root. In an Atlassian Crowd deployment that had Jira configured, reading WEB-INF/classes/crowd.propertiesVulnerability ManagementExposure Command, Vulnerability Management, and Nexpose