Vulnerabilities · Threat Intelligence · Application Security
Atlassian flaw lets attackers read files in Jira, Confluence and more without logging in
A critical flaw in Atlassian's self-hosted products lets attackers read certain files without logging in. Exploitation began within hours of public disclosure, affecting Jira, Confluence, Bitbucket and others.
Ross GrantUpdated 3 min read
The short version
A serious security flaw in Atlassian's self-hosted tools like Jira and Confluence lets attackers read certain files without logging in, if they know the file's exact name and location. Hackers started trying to exploit this within hours of the details being made public. Atlassian has released updates to fix the problem and urges customers to patch right away.
What happened?
A critical vulnerability (CVE-2026-21589) in Atlassian's self-hosted Data Center products allows unauthenticated attackers to read files if they know the exact path. Exploitation attempts began within hours of public disclosure, targeting Jira, Confluence, Bitbucket, and others. Atlassian has released patches and urged immediate updates.
What is the Atlassian vulnerability?
A critical security flaw, tracked as CVE-2026-21589, has been found in eight Atlassian Data Center products. These are self-hosted versions of popular tools such as Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The flaw allows anyone on the network, without needing to log in, to read specific files from the web application’s root directory, if they know the exact file name and location. Attackers cannot list all files, but if they guess or know a sensitive file’s path, they can access its contents.The Hacker News (opens in a new tab)BleepingComputer (opens in a new tab)
How quickly was it exploited?
Exploitation attempts began within two hours of public technical details and a proof-of-concept (PoC) being released. Security researchers at Previdian observed attackers scanning for vulnerable systems and trying to access files. Most early activity focused on identifying exposed systems and reading common configuration files, rather than launching further attacks. However, the rapid appearance of automated scanning tools means exploitation is expected to increase.The Hacker News (opens in a new tab)BleepingComputer (opens in a new tab)
What could attackers do?
If attackers know the location of sensitive files, they can read them. In some setups, this includes files with credentials or keys. For example, in Crowd-integrated Jira deployments, attackers could access the crowd.properties file, which stores credentials for Atlassian’s identity management system. With these, they could create new admin accounts or change privileges. The flaw does not let attackers list files or write to the system, but reading the right file can lead to full compromise in some cases.The Hacker News (opens in a new tab)BleepingComputer (opens in a new tab)
Which products and versions are affected?
All self-hosted Data Center versions of the following Atlassian products released before the fixed versions are vulnerable:
- Bitbucket Data Center: before 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center: before 9.2.26, 10.2.19
- Jira Service Management Data Center: before 5.12.40, 10.3.26, 11.3.12
- Jira Software Data Center: before 9.12.40, 10.3.26, 11.3.12
- Bamboo Data Center: before 10.2.24, 12.1.12
- Crowd Data Center: before 6.3.7, 7.0.3, 7.1.7, 7.2.4
Cloud-hosted Atlassian products have already been patched. Bitbucket Cloud is not affected. The situation for older Server editions is unclear, as Atlassian’s advisory does not mention them, but the CVE record lists them as affected with no fixed versions.The Hacker News (opens in a new tab)
What should administrators do?
Atlassian urges all customers running self-hosted instances to patch immediately. If patching is not possible right away, temporary mitigations include:
- Restricting external network access
- Adding web application firewall (WAF) or reverse proxy rules to block traversal patterns
- Applying specific rewrite rules (Tomcat RewriteValve for some products, urlrewrite.xml for Bitbucket)
These mitigations must be applied to every node in a cluster and are not a substitute for patching. Atlassian also recommends reviewing access logs for suspicious requests matching the traversal patterns described in their advisory. The company cannot determine if a given customer’s instance has been compromised, so local investigation is needed.BleepingComputer (opens in a new tab)
What is path traversal?
This flaw is a type of path traversal vulnerability. It lets attackers craft URLs that trick the application into serving files outside the intended directory. In this case, Atlassian’s web-resource handling converts double colons (::) into slashes (/), allowing attackers to reach protected files if they know the exact path. The flaw is rated 9.3 out of 10 on the CVSS scale, meaning it is considered critical.The Hacker News (opens in a new tab)
Previous context
Atlassian has faced similar issues before. In 2024, CVE-2021-26086, another path traversal flaw in Jira, was added to the US Cybersecurity and Infrastructure Security Agency’s list of known exploited vulnerabilities.
What happens next?
With public exploit code available and automated scanning underway, unpatched systems are at high risk. Administrators should patch as soon as possible and monitor for signs of compromise. Organisations that process personal data may face regulatory scrutiny and, in some regions, significant fines if sensitive information is exposed.
Claimed vs confirmed
- Confirmed
Attackers exploited the flaw within two hours of public technical details being released.
Previdian and watchTowr observed exploitation attempts on honeypots within two hours of public disclosure.
- Confirmed
Attackers can use the flaw to gain admin access by reading credentials from configuration files.
Researchers demonstrated that reading the crowd.properties file could allow admin account creation in some setups.
- Confirmed
Cloud-hosted Atlassian products are not affected.
Atlassian and multiple sources state cloud products have been patched and Bitbucket Cloud is not affected.
The impact
- Money
- If sensitive data is exposed, organisations may face regulatory fines. Under UK GDPR, fines can reach £17.5m or 4% of global turnover. No direct losses have been reported yet.
- Reputation
- Widespread use of Atlassian products means a breach could damage trust and lead to scrutiny from customers and regulators.
- Customers
- Customers running self-hosted Atlassian products should patch immediately. If attackers access configuration files, credentials and internal data may be at risk.
Why it matters
Many organisations use Atlassian tools for project management and development. If attackers access sensitive files, they could steal credentials or other data, leading to further attacks or data breaches. Unpatched systems are at high risk, especially with public exploit code available.
How does it work?
The flaw is a path traversal vulnerability. Attackers craft URLs with special patterns (using double colons '::' that Atlassian's code converts to slashes '/') to access files in the web application root directory. They must know the exact file name and path. The flaw does not allow listing directories or writing files, but reading sensitive files can lead to further compromise.
Key points
- Critical flaw in Atlassian Data Center products allows file reading without login
- Attackers began exploiting the flaw within hours of public disclosure
- Sensitive files like credentials may be at risk if attackers know their paths
- Patching is the only full fix; mitigations are temporary
- Cloud-hosted Atlassian products are already patched
Sources
The Hacker News
Reference
BleepingComputer
Reference
Security Affairs
Reference
SecurityWeek
Reference
