What exactly can be stolen via CVE-2026-21589?

Specific files inside the web application's root directory — including configuration files with credentials. In the worst case, if Atlassian Crowd is used for SSO, this can lead to administrator access in Jira.

Is Atlassian Cloud (Jira Cloud, Confluence Cloud) affected?

No. The vulnerability only affects self-hosted (Data Center) versions of the products. Atlassian closed the gap on its cloud infrastructure in advance, so Cloud customers don't need to do anything.

Will a VPN protect against exploitation of this vulnerability?

No — the vulnerability operates at the server application level, and the only reliable fix is updating Atlassian to the patched version. A VPN encrypts your own network traffic but doesn't fix vulnerabilities on someone else's server.

← All news

October 13, 2026

Atlassian Flaw Let Attackers Read Files in Jira and Confluence

Emily ParkerContent & SEO Specialist

Atlassian Flaw Let Attackers Read Files in Jira and Confluence

In short: On October 5, 2026, Atlassian disclosed a critical vulnerability, CVE-2026-21589 (CVSS 9.3), affecting eight self-hosted Data Center products at once — Jira, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. It lets an attacker read specific files on the server without any login, including configuration files that can hold credentials. Two hours after watchTowr researchers published a technical write-up and working proof-of-concept code, attackers were already scanning the internet en masse for vulnerable servers. Patches shipped alongside the disclosure — if your company runs self-hosted Atlassian, updating isn't optional.

What happened

The flaw lives in atlassian-plugins-webresource, a library shared across all eight products. A routing bug meant that a function meant to simply convert double colons (::) into forward slashes let attackers smuggle a path-traversal payload past directory-traversal defenses to reach an arbitrary file inside the web application's root directory. No account is needed — only the exact name and path of the target file (the bug doesn't allow browsing or listing directory contents).

The most dangerous scenario involves Atlassian Crowd: if a company uses it for single sign-on, the flaw can expose WEB-INF/classes/crowd.properties, where integration credentials are stored in plain text. With those, an attacker could escalate to administrator access in Jira.

Who's at risk

Every version of all eight Atlassian Data Center products is affected prior to the fixed releases: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Atlassian Cloud is not affected — there's nothing to patch there, since Atlassian closed the gap on its own infrastructure beforehand. If your organization runs a self-managed install of any of these products, that's a direct risk: Jira and Confluence routinely store employee personal data, internal correspondence, access tokens to other systems, and confidential documents.

How fast it was exploited

On October 5, Atlassian published a security advisory and shipped fixed versions. On October 6, watchTowr researchers reverse-engineered the attack mechanics and released a technical write-up with a working PoC. Within two hours of that publication, honeypot networks recorded the first exploitation attempts; by October 7, CrowdSec had counted 89 unique IP addresses sending matching requests. That speed is typical for critical vulnerabilities with a public PoC — administrators get hours, not days, before mass scanning begins.

What to do if you run one of these systems

Update Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, or Fisheye Data Center to the fixed version — the exact version numbers are listed in Atlassian's advisory.
If you can't patch immediately, apply the temporary mitigations: Atlassian publishes an Apache Tomcat RewriteValve rule (for Confluence, Jira, Bamboo, Crowd) and a separate urlrewrite.xml rule for Bitbucket. Treat these as temporary, not a substitute for patching.
Check web server logs for requests with suspicious double-colon patterns in the path — an indicator of exploitation attempts.
If Crowd is used for SSO, treat the integration credentials as potentially compromised and rotate them after updating.

If you have an account in a corporate Jira or Confluence instance — tickets with personal data, HR correspondence, or single sign-on access — change your password and review active sessions once IT confirms the systems are updated. For broader account-protection basics, see our guide on protecting an account from a hack.

Why this isn't just an IT problem

Vulnerabilities like this hit real people, not abstract "infrastructure" — Jira tickets and Confluence pages accumulate years of employee, client, and partner data, from addresses to internal pay discussions. When it's not your personal account that's breached but the corporate system you simply work in, the only thing left under your control is limiting the fallout: don't reuse passwords across services, and encrypt your own traffic on networks you don't trust. For password hygiene basics, see our piece on password manager security.

This specific flaw operates at the level of a company's server, and no VPN patches it — updating the Atlassian systems themselves is the only fix. But for protecting your own traffic while working from a café, airport, or hotel, an encrypted connection remains a useful separate layer: LiMP VPN hides which services you use from the network owner, with plans starting at 69 ₽/month — see pricing.

Sources

← All news