From a color-picker image to Atlassian's credential file

CVE-2026-21589 is an arbitrary file access flaw in Atlassian’s Data Center products, rated CVSS 9.3. An unauthenticated attacker who knows the exact name and path of a file inside the web application root can retrieve it with a single request. Previdian’s honeypots logged the first exploitation attempts two hours after watchTowr published the technical details.

The affected list is long: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd Data Center, plus Crucible and Fisheye. Atlassian says its Cloud products are already patched.

The bug lives in Atlassian’s web-resource handling. The code converts a string like ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml. An attacker who understands that resolution step can chain it onto a legitimate plugin resource path and use a trailing slash to climb out and reach other files. watchTowr’s example starts from a color-picker image path and walks up to web.xml:

GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1
Host: {{Jira-Hostname}}

The flaw does not let an attacker list directories or enumerate what is present, so they have to know the path already. For public Atlassian software that is a weak barrier, because the files worth reading sit in predictable locations.

On Crowd and Jira, the file that matters is WEB-INF/classes/crowd.properties, which holds Crowd credentials. Read those and you can authenticate to the application, create users, change privileges, and promote a rogue account to Jira Administrator. watchTowr describes the read as a path to tokens, credentials, keys, or other authentication material, and from there to full control.

So far the observed traffic is reconnaissance. watchTowr’s head of threat intelligence, Jake Knott, says most attempts have focused on fingerprinting affected products and sweeping for common config files and sensitive data, with no one yet seen using harvested credentials. Previdian counted 15 attempts from three IPs in Japan and the US:

• 38.60.157[.]86
• 146.70.187[.]234
• 159.26.119[.]225

Previdian’s Ryan Dewhurst expects that to change quickly. He notes a Nuclei template makes mass automated scanning easier, and the read-a-config-file-then-log-in chain is simple enough to script.

Patch versions by product:

• Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
• Confluence Data Center: 9.2.26, 10.2.19
• Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
• Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
• Bamboo Data Center: 10.2.24, 12.1.12
• Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Crucible: 4.9.15
• Fisheye: 4.9.15

If you cannot patch immediately, Atlassian’s mitigations are to pull the instance off the public internet, apply a WAF rule, and block the exploit path at the web layer: a Tomcat RewriteValve rule for Confluence, JSM, Jira, Bamboo and Crowd, and a urlrewrite.xml rule for Bitbucket.

One step is worth taking regardless of patch timing. If an instance was exposed while running an affected version, treat the Crowd credentials in crowd.properties as potentially read and rotate them. The reconnaissance phase is cheap and quiet, and patching the server does not undo a credential someone already pulled.