CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

What it is

CVE-2026-21589 (CVSSv4 9.3), disclosed by Atlassian on October 5, 2026, affects eight Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. Atlassian Cloud is already patched; no cloud action needed.

How it works

The flaw sits in Atlassian's web-resource handling (CWE-552): double-colon (::) sequences can act as path separators during request processing, letting ../ traversal components reach resource-loading code. watchTowr Labs confirmed this by diffing vulnerable vs. patched Jira, Confluence, and Bitbucket packages. An unauthenticated attacker who knows a target file's exact name and path can read its contents — but cannot list directories or enumerate filenames, so exploitation requires guessing known paths.

Preconditions / Affected

• All versions before the fixed releases are affected, including unsupported/EOL versions.
• Traversal is confined to the Tomcat context — watchTowr could not escape the application web root, but could read any file inside it.
• The credential-theft chain requires a specific layout: a Crowd deployment with Jira configured, where WEB-INF/classes/crowd.properties is reachable and exposes Crowd admin credentials. Escalating to a rogue jira-administrators account additionally requires network access to Crowd; Crowd's IP allowlisting can block that step.

What to do

• Upgrade to the fixed version listed in Atlassian's October 5 advisory for each affected product.
• If immediate patching isn't possible, take the instance off the internet or restrict external network access.
• Apply Atlassian's interim mitigations: a WAF/proxy rule for all affected products, a Tomcat RewriteValve rule for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd, and a separate urlrewrite.xml rule for Bitbucket. Atlassian and Rapid7 both stress these are partial, not substitutes for patching.
• Hunt access logs even after patching: URL-decode each request line up to twice and look for .. adjacent to /, \, or ::. Vendor regex for raw logs:

(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*

• If logs show access to protected config files, rotate exposed credentials/secrets after containing the system.
• Rapid7 Exposure Command/Vulnerability Management/Nexpose: unauthenticated check for Jira Software Data Center expected in the October 8 content release.

Caveats

watchTowr's testing was limited to Jira, Confluence, and Bitbucket packages and could not break out of the Tomcat context — impact on Bamboo, Crowd, Crucible, and Fisheye is inferred from the shared advisory, not independently verified by watchTowr. Public Python PoC and Nuclei templates already exist for the tested products, raising near-term exploitation risk.