/DISPATCH · 2026-10-08

Atlassian Patches Arbitrary File Read CVE-2026-21589 (CVSS 9.3)

CVE-2026-21589 is an unauthenticated arbitrary file read in multiple Atlassian Data Center and Server products, scored CVSS 4.0 9.3. Successful exploitation can expose configuration files and credentials, including JDBC strings, passwords, API tokens, and private keys.

Vulnerability overview

Name: arbitrary file read in multiple Atlassian products
IDs: QVD-2026-75562, CVE-2026-21589
Disclosure date: 5 October 2026
Affected scale: on the order of 100,000 instances
QiAnXin rating: high
CVSS 4.0: 9.3
Threat type: information disclosure
In-the-wild exploitation: not observed

Successful exploitation can disclose configuration files and credentials, including JDBC connection strings, passwords, API tokens, and private keys, and can lead to privilege escalation, account takeover, or lateral movement.

Affected products

Atlassian Data Center products are enterprise collaboration and development platforms. Bitbucket manages Git repositories. Confluence provides team knowledge bases and document collaboration. Jira Software and Jira Service Management support agile project management and IT service management. Bamboo provides CI/CD pipelines. Crowd provides unified identity and SSO. Crucible and Fisheye provide code review and code search. The products are widely deployed in enterprise software development and operations, including high-availability clusters.

Description

QiAnXin CERT reported that Atlassian has patched CVE-2026-21589, an unauthenticated arbitrary file read affecting multiple self-hosted Atlassian Data Center and Server products. The issue is in the shared library atlassian-plugins-webresource. A reachable affected instance may expose specified files under the web application root, including files in WEB-INF. Exposed material can include configuration files and credentials such as JDBC connection strings, passwords, API tokens, and private keys, which can enable privilege escalation, account takeover, or lateral movement.

QiAnXin CERT advises customers to inventory affected instances and apply vendor fixes.

Affected versions

4.6.0 <= Bitbucket Data Center < 9.4.26
10.0.0 <= Bitbucket Data Center < 10.2.8
10.3.0 <= Bitbucket Data Center < 10.5.1
5.10.0 <= Confluence Data Center < 9.2.26
10.0.0 <= Confluence Data Center < 10.2.19
2.11.0 <= Crowd Data Center < 6.3.7
7.0.0 <= Crowd Data Center < 7.0.3
7.1.0 <= Crowd Data Center < 7.1.7
7.2.0 <= Crowd Data Center < 7.2.4
7.1.0 <= Jira Software Data Center < 9.12.40
10.0.0 <= Jira Software Data Center < 10.3.26
11.0.0 <= Jira Software Data Center < 11.3.12
3.1.0 <= Jira Service Management Data Center < 5.12.40
10.0.0 <= Jira Service Management Data Center < 10.3.26
11.0.0 <= Jira Service Management Data Center < 11.3.12
7.0.1 <= Bamboo Data Center < 10.2.24
12.0.0 <= Bamboo Data Center < 12.1.12
Crucible < 4.9.15
Fisheye < 4.9.15

Patches

Vendor fixes are available. Affected users should upgrade to:

Bitbucket Data Center >= 9.4.26
Bitbucket Data Center 10.0.* >= 10.2.8
Bitbucket Data Center 10.3.* >= 10.5.1
Confluence Data Center >= 9.2.26
Confluence Data Center 10.0.* >= 10.2.19
Crowd Data Center >= 6.3.7
Crowd Data Center 7.0.* >= 7.0.3
Crowd Data Center 7.1.* >= 7.1.7
Crowd Data Center 7.2.* >= 7.2.4
Jira Software Data Center >= 9.12.40
Jira Software Data Center 10.0.* >= 10.3.26
Jira Software Data Center 11.0.* >= 11.3.12
Jira Service Management Data Center >= 5.12.40
Jira Service Management Data Center 10.0.* >= 10.3.26
Jira Service Management Data Center 11.0.* >= 11.3.12
Bamboo Data Center >= 10.2.24
Bamboo Data Center 12.0.* >= 12.1.12
Crucible >= 4.9.15
Fisheye >= 4.9.15

Official advisory: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html

Related ticket: https://jira.atlassian.com/browse/BAM-26567

Temporary mitigation

If an upgrade cannot be applied immediately, restrict external network access and isolate the instance from the public internet.