Published on October 19, 2026 at 4:09 PM

CVE-2026-21589 is a critical vulnerability affecting several Atlassian products, including Jira, Confluence, and Bitbucket Data Center. This vulnerability allows unauthenticated attackers to read arbitrary files on the server, posing significant security risks.

What the vulnerability is

The vulnerability resides in the shared atlassian-plugins-webresource library used by these products. It improperly handles double colons (::) as path separators in resource routing. This flaw enables attackers to traverse the filesystem and access sensitive files.

Technical details

While specific technical details such as the CVSS score, CWE number, and attack vector have not been published, the vulnerability is classified as a pre-authentication arbitrary file read issue. This means attackers can exploit it without needing valid credentials.

Impact

Exploitation of this vulnerability allows attackers to read files within the application server’s webroot. This includes critical configuration files like web.xml and crowd.properties, which may contain plaintext credentials. Such access can lead to further compromise of the affected systems.

Affected systems

Affected systems have not been publicly disclosed at the time of writing. However, it is known that the vulnerability impacts Atlassian Jira, Confluence, and Bitbucket Data Center.

Mitigation

To mitigate this vulnerability, it is recommended to update to the fixed versions of the affected products. The patched versions are:

• Jira: 9.12.40, 10.3.26, 11.3.12
• Confluence: 9.2.26, 10.2.19
• Bitbucket: 9.4.26, 10.2.8, 10.5.1
• Bamboo: 10.2.24, 12.1.12
• Crowd: 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Crucible/Fisheye: 4.9.15

Administrators should ensure their systems are updated to these versions to protect against potential exploitation.

Continuous scanning and timely updates are crucial in identifying and mitigating vulnerabilities like CVE-2026-21589 before they can be exploited by attackers.