Red alert CVE-2026-21589: CVSS 9.3 vulnerability threatens the Atlassian "backbone" of businesses
About Atlassian
Overview of Atlassian
- Atlassian is a world-leading enterprise software company founded in Australia. The company specializes in providing tools to support teamwork, project progress tracking, software development and IT service management.
- Atlassian products are designed to be closely linked together, helping teams from technical (programming, IT) to business (human resources, marketing) coordinate their work seamlessly, transparently and effectively.
Atlassian's main products and services
- Jira Software: Is the most popular project management and issue tracking tool today. Support Agile working methods (Scrum, Kanban), helping teams plan, divide work and track product release progress.
- Confluence: Is a digital workspace and internal knowledge management (enterprise wiki). Enables members to collaboratively create, store, and share project documents, technical diagrams, and workflows.
- Bitbucket: A Git-based source code management and storage service for programming teams. Deep integration with Jira to automatically update work status when there are changes in the source code.
- Jira Service Management (JSM): Is an IT service management (ITSM) and support desk (Helpdesk) platform. Allows receiving, troubleshooting, technical requests and customer support in a professional manner.
- Trello: Is a visual task management tool in the form of a drag-and-drop board (Kanban board). Suitable for individuals or small groups who need to manage daily work simply and quickly.
- Bamboo: Is a software packaging and testing (CI/CD) automation server, helping to convert source code from programmers into ready-to-deploy builds.
- Atlassian Crowd: Is an identity management and single sign-on (SSO) solution on internal servers, allowing employees to use just one account to log in to Jira, Confluence and Bitbucket.
Atlassian deployment models
- Atlassian Cloud: Is a software-as-a-service (SaaS) version stored and operated directly on Atlassian's cloud infrastructure. Users just need to register to use it immediately, automatically updating new features without needing to install or maintain the server.
- Atlassian Data Center: Is a version for large businesses that need to be installed on private server systems (on-premises or private cloud). Provides clustering capabilities, ensuring high availability, stable performance and full control over data security.
Technical Landscape and Affected Versions
On October 5, 2026, Atlassian released an urgent security bulletin warning about the Arbitrary File Access vulnerability carrying the identifier CVE-2026-21589.
- CVE ID: CVE-2026-21589
- CVSS v4.0 Score: 9.3 (Critical)
- CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H(According to Atlassian's official assessment) - CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) / CWE-23 (Relative Path Traversal)
- Attack Vector: Network, no privileges required (PR:N), no user interaction required (UI:N), low exploitation complexity (AC:L).
The vulnerability affects all versions released before the corresponding patches on 8 Data Center products:
| Product | Affected Versions | Fixed LTS Versions |
|---|---|---|
| Bitbucket Data Center | All versions prior to the patched releases | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | All versions prior to the patched releases | 9.2.26, 10.2.19 |
| Jira Software Data Center | All versions prior to the patched releases | 9.12.40, 10.3.26, 11.3.12 |
| Jira Service Management Data Center | All versions prior to the patched releases | 5.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | All versions prior to the patched releases | 10.2.24, 12.1.12 |
| Crowd Data Center | All versions prior to the patched releases | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | All versions prior to the patched releases | 4.9.15 |
| Fisheye | All versions prior to the patched releases | 4.9.15 |
Vulnerability Analysis
The fact that a vulnerability appears simultaneously in all 8 core Atlassian products reflects the existence of a faulty shared source code component. The binary diffing process between the vulnerable installation and the patch has pinpointed the error-causing component in the library: atlassian-plugins-webresource*.jar
Specifically, the comparison between atlassian-plugins-webresource-6.0.7.jar and atlassian-plugins-webresource-6.0.8.jar reveals the technical roots of the exploit.
Root cause of error at Router layer: Bypass via :: character
Inside the com.atlassian.plugin.webresource.impl.http.Router.java package, Atlassian defines functions that handle web resource routing. Worth noting is the path conversion method:
The unescapeSlashes function replaces the entire string of colons :: into slashes /. This is an internal mechanism designed to serialize/deserialize resource URLs without conflicting with the standard HTTP URL path structure.
However, this mechanism accidentally opens a serious Path Traversal vulnerability. When an attacker sends a character string of the form ..::..::..::, all security checking mechanisms at the edge layer (WAF, Reverse Proxy, Servlet Filter) only look for the traditional directory traversal string (../, .., %2e%2e%2f). When the query passes the boundary check layer and enters the Router.java router, the new unescapeSlashes function is fired, converting ..:: to ../ just before the resource is read from the hard disk.
The stream calls the function and the Sink reads the resource
In Router.java, routes serving static resources are declared as follows:
After decoding the slash, the function forwards the handle to com.atlassian.plugin.webresource.impl.helpers.ResourceServingHelpers.java. Here, the getResourceRelativeToWebResource() method is called:
Even though it is marked @Deprecated, this function is still triggered in the default execution flow. The createResourceWithRelativePath() method directly receives the filePath value containing the relative path that has been tampered with by the attacker, then reads the file content from the local file system without checking the path containment (checking the root directory limit).
Trigger Point on products
To trigger the file read flow, an attacker needs to target a plugin module whose resources end with a slash / in the plugin configuration file (allowing arbitrary filename concatenation).
In jira-webresources-plugin.jar, the trigger point appears at the resource color picker popup:
By targeting the corresponding endpoint combined with the traversal string ..::, an attacker can retrieve the web application configuration file.xml:
GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1
Host: jira.victim.com
The server responds with the original content of the file:
The same query pattern also works on other products:
- Confluence:
GET /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml HTTP/1.1 - Bitbucket:
GET /s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml HTTP/1.1
Due to limitations of the Tomcat Container context, this traversal string cannot escape the operating system (cannot read /etc/shadow or C:\Windows\System32), and does not support directory enumeration. However, the ability to read any file in WEB-INF/ is enough to set the stage for a system takeover attack.
Privilege escalation chain: From File Read to Jira Administrator via Crowd
The true danger of CVE-2026-21589 is most evident in businesses that use Atlassian Crowd as a centralized name server (SSO/IAM) for the entire Atlassian infrastructure.
When Jira is configured to connect to Crowd, application credentials are saved directly in the file: WEB-INF/classes/crowd.properties
Exploit the vulnerability to read this file:
GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::classes::crowd.properties HTTP/1.1 Host: jira.victim.com
The returned result contains the application authentication information in plaintext:
Grasping application.name and application.password, the attacker authenticates directly to the Crowd REST API with the authority of the Jira application itself. From here, the hacker performs a two-step sequence to create the complete backdoor:
Step 1: Create a new user account on Crowd:
Step 2: Assign users to the supreme administrator group:
After this step, the attacker returns to the Jira web login interface, logs in with the backdoor_admin account and takes full control (Jira Administrator), allowing the installation of malicious plugins to achieve Remote Code Execution (RCE) on the server.
Recording Actual Exploitation and PoC Status
According to Atlassian's October 5, 2026 newsletter, the company had not recorded widespread exploit attacks targeting Cloud customers at the time of the patch release. However, the dangerous nature of the vulnerability has attracted special attention from security researchers and threat groups.
- PoC status: On October 6, 2026, the watchTowr Labs research team published a detailed analysis with the source code of the scanning tool (Detection Artefact Generator - DAG) on GitHub (watchTowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589). This tool automatically sends probe payloads to all three targets Jira, Confluence and Bitbucket.
- Weaponization of exploit code: The complete exploit code from reading files to creating a Jira Administrator account via Crowd was demonstrated in detail. Due to the simple nature of pre-auth and payload, the risk of vulnerabilities being automatically introduced into large-scale scanning botnets is immediate.
MITRE ATT&CK
The complete attack chain combining web vulnerability exploitation and identity management API abuse is specifically mapped to the MITER ATT&CK standard:
| Tactic | Technique | Technique ID | Detailed Behavioral Description |
|---|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 | Exploits a path traversal vulnerability using ..:: through the webresource endpoint without requiring authentication. |
| Credential Access | Unsecured Credentials: Credentials in Files | T1552.001 | Extracts the application's plaintext password from the WEB-INF/classes/crowd.properties file. |
| Persistence | Create Account: Cloud / Enterprise Accounts | T1136.003 | Uses the Crowd REST API to create a new backdoor user account in the centralized directory. |
| Privilege Escalation | Valid Accounts: Cloud / Enterprise Accounts | T1078.004 | Adds the newly created account to the jira-administrators group to gain full administrative privileges over the application. |
Detection Methods and Defense Measures
To protect the system before completing a version update, operations teams need to combine log monitoring measures, apply filtering rules at the WAF, and configure blocking at the application server layer.
Detection logic on Web Server Access Log / Reverse Proxy
An attacker can use multiple layers of URL encoding to evade detection (e.g. %3a%3a instead of ::, or double URL encoding %253a%253a). Therefore, the log parsing process needs to perform URL-decoding at least twice before matching the string.
Identification signs on the log:
- Query targeting resource paths:
/download/resources//s/*/_/download/resources/
- Contains the following character strings:
- :: goes with .. (for example: ..:: or ::..)
- .. is adjacent to /, , or ::
- Sensitive file names: web.xml, crowd.properties, urlrewrite.xml, database.properties
Configure emergency containment WAF
Atlassian recommends configuring regex rules on web application firewall devices (Cloudflare, AWS WAF, F5 BIG-IP, Nginx):
(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*
Temporary mitigation solution (Workaround when patching is not possible)
If downtime cannot be arranged to upgrade the version immediately, the administrator must configure a filter on the application server:
- Using Apache Tomcat RewriteValve (For Jira, Confluence, Bamboo, Crowd):
Open the file conf/server.xml (on Confluence, Jira, Bamboo) or apache-tomcat/conf/server.xml (on Crowd).
Add the Valve configuration inside the <Host name="localhost" ...> tag:
Create or edit the file conf/Catalina/localhost/rewrite.config:
RewriteCond %{REQUEST_URI} ^.(..::|::..).$ [NC,OR]\ RewriteCond %{REQUEST_URI} ^.WEB-INF.$ [NC]\ RewriteRule ^.*$ - [F]Restart the service on each node in the cluster.
- Using urlrewrite.xml (Bitbucket Data Center Exclusive):
- Open Bitbucket's URL rewrite configuration file and add a rule to block queries containing the string ::.
- Network Access Limitation (Network ACL) for Atlassian Crow
Expert Comments
The CVSS v4.0 score of 9.3 very accurately reflects the severity of CVE-2026-21589. Even though it was just an Arbitrary File Access bug and limited to the application container, the existence of configuration files containing plaintext passwords of integrated components (like Atlassian Crowd) turned a file reading error into a full-blown privilege escalation springboard.
In Vietnam, Atlassian Data Center products such as Jira, Confluence and Bitbucket serve as the "backbone" in software development, project management and technical document storage for most banks, financial institutions, telecommunications businesses and large technology corporations. Actual surveys from information security monitoring activities show that many organizations are directly publishing the Jira Service Management interface (to receive customer support requests) or the Confluence portal to the Internet. This is an extremely lucrative attack surface.
In terms of attack trends, CVE-2026-21589 represents a new advancement in circumvention techniques:
- Use of non-traditional delimiter characters: Instead of using the standard slash, the application itself transforms the :: string into a directory delimiter which massively disables traditional blacklist-based WAF signatures.
- Exploiting internal integration architecture: Modern hackers do not only look for RCE directly through deserialization or injection, but focus on exploiting weaknesses in the inter-application authentication architecture (Identity Brokerage). The fact that crowd.properties stores passwords unencrypted is a huge boon for any attack chain that gains permission to read the file.
Recommended Action
Immediate (0 - 24 hours)
- Exposure Check: Check all Atlassian servers that have an open interface to the Internet. If public service is not required, immediately bring the system back to the local network or via VPN/ZTNA port.
- Apply an emergency WAF filter: Inject the regex that blocks the strings :: and .. into the web firewall system before performing source code updates.
- Automated testing: Use internal DAG tool to check if current Jira, Confluence, Bitbucket versions respond to test payloads.
Short-term (1 - 7 days)
- Official patch upgrade: Plan maintenance and update the entire Data Center server farm to patched fixed versions (Jira 9.12.40 / 10.3.26 / 11.3.12; Confluence 9.2.26 / 10.2.19; Bitbucket 9.4.26 / 10.2.8 / 10.5.1...).
- Lock down the Atlassian Crowd port: Configure a strict Access Control List (ACL) at the internal switch/firewall, only allowing the specific IP address of the Jira/Confluence server to connect to Crowd's port 8095.
- Threat Hunting: Check the entire access log for the last 60 days to detect probe requests containing the string ..:: or unusual access to crowd.properties. Also review the list of accounts belonging to the jira-administrators group on both Jira and Crowd to detect strange accounts that have been created recently.
Long-term
- Secure configuration password management: Avoid saving plaintext passwords in properties files; Apply a centralized secret storage solution (like HashiCorp Vault) or security modules that support credential encryption when integrated.
- File integrity monitoring (FIM): Set up EDR/FIM tools to closely monitor any write or modification of files in the WEB-INF/ directory and Tomcat installation directory.
- Shift to Zero Trust architecture (ZTNA): Minimize direct opening of internal collaboration tools (like Jira/Confluence/Bitbucket) to the public Internet, replace with identity-based access solutions and multi-factor authentication (MFA).
References
Comments
Join the discussionPatch windows are the real constraint for most businesses.
