CVE-2026-21589: file disclosure in Atlassian products

Researchers at watchTowr Labs investigated the critical vulnerability CVE-2026-21589, which affects several self-hosted Atlassian products: Jira, Confluence, Bitbucket, Bamboo, and others. The vulnerability was caused by an error in the shared library atlassian-plugins-webresource, which handles web resources. The vulnerability allows an unauthenticated user to read arbitrary files within the application's web directory.

When processing HTTP requests, the library replaces / with ::, then restores the original path separators. The researchers found that this normalization makes it possible to bypass path validation and inject a path traversal sequence. As a result, they were able to read files such as WEB-INF/web.xml through externally accessible resource-loading endpoints. In some configurations, accessible files may contain integration credentials and other secrets. Atlassian has released fixes for the affected products.

Exploiting the vulnerability allows an attacker to access configuration files, source data, and secrets stored on the application server without authentication. In particular, the researchers demonstrated a chain in which reading crowd.properties disclosed the password for integration with Atlassian Crowd—the centralized account management system. If Crowd was accessible using these credentials, the attacker could create users and change their privileges, potentially gaining administrative access to Jira.

Article: https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/