CVE-2026-21589

What is Atlassian Data Center?

Atlassian Data Center is the self-hosted, clustered edition of Atlassian's development and collaboration suite: Jira Software and Jira Service Management for issue and ticket tracking, Confluence for documentation, Bitbucket for Git hosting, Bamboo for CI/CD, Crowd for single sign-on and directory integration, and Crucible and Fisheye for code review and repository browsing. Organisations choose Data Center over Atlassian Cloud when they want the data on their own infrastructure, which usually means regulated industries, large enterprises and government.

That makes these servers unusually valuable targets. A single Confluence or Jira instance typically holds credentials, architecture diagrams, incident runbooks and customer data, while Bitbucket and Bamboo hold source code and deployment pipelines. Crowd is worse still: it is the identity broker that the other products trust.

Overview

CVE-2026-21589 is an unauthenticated arbitrary file read affecting all eight self-hosted Atlassian products listed above. An attacker who can reach the web interface, with no account and no user interaction, can retrieve specific files from inside the web application root, including files under WEB-INF that are never meant to be served.

Atlassian published the advisory out of band on 2026-10-05 and rated it critical with a CVSS 4.0 score of 9.3. NVD's CVSS 3.1 score of 7.5 is lower because the 3.1 model does not capture the downstream effect of the files that can be read. The vendor stresses two real limits: exploitation requires knowing the exact name and path of the target file, and the bug does not allow directory listing or enumeration. In practice those limits matter less than they sound, because the interesting file paths are fixed and identical on every installation.

Atlassian Cloud was patched before the advisory went out and needs no customer action. CISA added the CVE to the KEV catalog on 2026-10-15 with a three-day federal remediation deadline of 2026-10-18, an unusually short window that reflects both the exposure and the ease of exploitation.

Affected Versions

Technical Details

The flaw lives in atlassian-plugins-webresource, the shared library every Data Center product uses to serve static plugin resources under paths such as /download/resources/ and /resources/. That library encodes forward slashes in resource identifiers as :: and decodes them again later. A deprecated resource-resolution path performs the decode after its safety checks, so traversal sequences written with :: instead of / survive validation and then become real directory separators when the file is opened. The result is the classic CWE-552 outcome: files that should sit outside the servable tree become reachable over HTTP.

Attack characteristics are about as bad as they get for a read primitive: network reachable, no authentication, no user interaction, low complexity, and a single GET request per file. Traversal stays inside the Tomcat context, so this is not a whole-filesystem read, but that context contains the deployment descriptors and configuration. watchTowr demonstrated retrieving WEB-INF/web.xml on Jira and Confluence and WEB-INF/urlrewrite.xml on Bitbucket, where web.xml itself is blocked.

The sharp edge is WEB-INF/classes/crowd.properties. Where a product is integrated with Crowd, that file holds the Crowd application name and password in plaintext. watchTowr showed the chain from there: authenticate to Crowd with the leaked credentials, create a user, add it to a group such as jira-administrators, and the file read becomes administrative access.

Discovery

Neither Atlassian's advisory nor the public reporting names an external reporter, and Atlassian did not publish a discovery credit. The first public signal was an operational one: Atlassian attached a mitigation file to a public Jira ticket on 2026-10-02, three days before the advisory. The technical analysis that made the bug concrete came from watchTowr Labs on 2026-10-06, authored by Sonny, Piotr Bazydlo and Yordan Ganchev, who reverse-engineered the patch, published proof-of-concept requests and released a detection artifact generator for Jira, Confluence and Bitbucket.

Exploitation Context

Sources conflict on when exploitation began, and the conflict is worth stating plainly. Atlassian said at publication that it had no evidence of exploitation and that it cannot tell individual customers whether their instance was hit. watchTowr Intelligence stated that as of 2026-10-06 it had observed in-the-wild exploitation, although its own summary table still listed exploitation as not reported, so that page is internally inconsistent. VulnCheck added the CVE to its exploited list on 2026-10-07, citing activity against Bamboo Data Center. CISA's KEV addition on 2026-10-15 settles the question for compliance purposes.

No threat actor or campaign has been attributed publicly, and no ransomware use has been reported. No reliable count of internet-exposed vulnerable instances has been published; watchTowr said only that it found exposure across its client base without giving a figure. Treat the lack of a number as an absence of data, not as evidence that exposure is small, since internet-facing Jira, Confluence and Bitbucket are common.

Remediation

1. Upgrade to a fixed release: Bitbucket 9.4.26, 10.2.8 or 10.5.1; Confluence 9.2.26 or 10.2.19; Jira Software 9.12.40, 10.3.26 or 11.3.12; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Crucible and Fisheye 4.9.15.
2. If you cannot patch immediately, remove the instance from the internet or restrict external access. Authentication at the application layer does not help here, so a network control is the only reliable stopgap.
3. Apply a vendor workaround in the meantime: the WAF or reverse-proxy rule from the advisory for any product, the Tomcat RewriteValve rewrite.config block for Confluence, Jira, Jira Service Management, Bamboo and Crowd, or the urlrewrite.xml rule for Bitbucket. Apply it on every cluster node, including Bitbucket mirrors and mirror farm nodes, and test it against URL-encoded variants.
4. Review access logs for requests under /download/resources/ and /resources/ containing .. next to /, \ or ::, URL-decoding up to two passes before matching. Atlassian publishes a regex for this in its advisory.
5. If any such request succeeded, treat WEB-INF/classes/crowd.properties as compromised: rotate the Crowd application password, audit Crowd for new accounts and group membership changes, and review administrator group membership in each connected product.
6. Meet the CISA KEV remediation deadline of 2026-10-18 for federal civilian agencies. Everyone else should treat that date as the benchmark given confirmed exploitation and a trivially reproducible attack.