CVE-2026-21589 is a path traversal vulnerability (arbitrary file access) in eight self-managed Atlassian products. An unauthenticated attacker with network access can read specific files inside the web application root directory by sending a crafted request. The attacker must already know the exact file name and path, and cannot list directories

The flaw does not give code execution directly, but exposed configuration files can lead to a full compromise. watchTowr showed that where Jira is integrated with Crowd, an attacker can read crowd.properties, which stores the Crowd application credentials in plaintext, and use them to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this path. Atlassian Cloud has already been patched and Cloud customers need no action.

The following self-managed Atlassian products are affected. All versions before the fixed releases are vulnerable:

• Bitbucket Data Center
• Confluence Data Center
• Jira Software Data Center
• Jira Service Management Data Center
• Bamboo Data Center
• Crowd Data Center
• Crucible
• Fisheye

Not affected / patched version:

• Bitbucket Data Center 9.4.26, 10.2.8 or 10.5.1
• Confluence Data Center 9.2.26 or 10.2.19
• Jira Software Data Center 9.12.40, 10.3.26 or 11.3.12
• Jira Service Management Data Center 5.12.40, 10.3.26 or 11.3.12
• Bamboo Data Center 10.2.24 or 12.1.12
• Crowd Data Center 6.3.7, 7.0.3, 7.1.7 or 7.2.4
• Crucible and Fisheye 4.9.15
• Atlassian Cloud products are already patched

Successful exploitation may allow attackers to:

• Read configuration files and secrets stored in the web application root without logging in
• Steal credentials, for example the plaintext Crowd application password in crowd.properties, and use them to create administrator accounts in Jira
• Use the compromised Atlassian server, which holds source code, tickets and build pipelines, as a foothold into the network

CERTVU recommends the following:

1. Patch to the fixed release

   Upgrade each self-managed instance to a fixed version for its branch, starting with internet-facing instances. This is the permanent fix.

2. Apply temporary mitigations if patching is delayed

   Take the instance off the public internet, or apply a WAF or reverse proxy rule blocking path traversal sequences including URL-encoded variants. Atlassian also provides a Tomcat RewriteValve workaround for Confluence, Jira, Bamboo and Crowd, and a urlrewrite.xml rule for Bitbucket. Back up before applying these. They reduce the risk but do not replace patching.

3. Hunt for compromise

   Report suspected compromise to CERTVU.