Atlassian CVE-2026-21589 Reads Files Without a Login in Eight Data Center Products, and Crowd Keeps Its Password in One

An unauthenticated attacker who knows a file's exact name and path can read it from eight Atlassian Data Center products, and on Crowd that file can hold the application's password in plaintext. CISA added the flaw, CVE-2026-21589, to its Known Exploited Vulnerabilities catalogue on October 15 with a due date of October 18 for federal agencies.

Atlassian published its advisory on October 5 and rates the flaw 9.3 on CVSS 4.0 (network, no privileges, no user interaction, high confidentiality impact). Its own page says Cloud products are patched and that the company "has not found evidence of exploitation" there. For Data Center, it says it "cannot confirm if your instances have been affected."

What an attacker can read with CVE-2026-21589

The advisory describes the flaw as one that "allows an unauthenticated attacker to access specific files within the web application root directory." It adds that exploitation "requires prior knowledge of the target file's exact name and path," and that an attacker cannot list directories.

watchTowr Labs published a write-up on October 6, one day after the advisory. Its researchers compared version 6.0.7 of the atlassian-plugins-webresource component with the fixed 6.0.8. Requests to /sources/ and /resources/ pass through helpers that swap / for :: and back, and a deprecated method called getResourceRelativeToWebResource still runs. The :: encoding lets traversal sequences survive the path filtering and turn back into / later, when the path is resolved against the local filesystem.

watchTowr said reads stay inside Tomcat's webapp context. It read WEB-INF/web.xml on Jira and Confluence, and WEB-INF/urlrewrite.xml on Bitbucket, where web.xml is blocked. Those are configuration files, not credentials, so the severity depends on what else sits under the web root.

Why Crowd is the product to check first

The file that makes the score credible is WEB-INF/classes/crowd.properties. Where Crowd integration is configured, watchTowr said, it holds the application name and password in plaintext. In its lab, the leaked credentials gave administrative control over Crowd, including user and group management. The researchers did not publish abuse steps.

Atlassian's advisory says only that "in some configurations, there may be sensitive files present that increase your risk." watchTowr said that an IP allow-list on Crowd would make the attack harder.

Fixed versions

All versions before the ones below are affected. Atlassian says binary patches are no longer released, so the fix means upgrading.

Product	Fixed versions
Bitbucket Data Center	9.4.26, 10.2.8, 10.5.1
Confluence Data Center	9.2.26, 10.2.19
Jira Service Management Data Center	5.12.40, 10.3.26, 11.3.12
Jira Software Data Center	9.12.40, 10.3.26, 11.3.12
Bamboo Data Center	10.2.24, 12.1.12
Crowd Data Center	6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible and Fisheye	4.9.15

What the October 15 listing does and does not show

CISA's catalogue entry marks ransomware use as unknown and sets the forensic-triage flag to "Yes". CISA's BOD 26-04 directive says that where triage applies, an agency must remediate within three days and also examine the asset for compromise. The entry does not say who is exploiting the flaw or against which products. Neither Atlassian's advisory nor watchTowr's post reports exploitation in the wild, so the KEV listing is the only exploitation signal in the sources reviewed.

The interval is the part worth noting. A write-up with a diffing method was public on October 6, and the catalogue entry followed nine days later.

The same three-day clock applied to the PAN-OS and Cisco gateway flaws and the two Ahsay flaws added on October 14, though the alerts those stories relied on listed no due date.

What to do

Upgrade to a fixed version from the table. Until then, take instances off the public internet, including those that require login, or add Atlassian's WAF rule that blocks .. beside path separators and ::, in URL-encoded form too. Search access logs for those sequences after URL-decoding each line twice. On Crowd, treat crowd.properties credentials as exposed and rotate them if the instance was reachable. Atlassian's advisory page carries the Tomcat and Bitbucket rewrite-rule alternatives.