# CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Unauthenticated path traversal via double-colon sequences in Atlassian web-resource handling lets attackers read arbitrary files in the web root, leaking Crowd credentials.

- Payout: Real-world hack
- Severity: critical
- Program: Atlassian
- Credited: Rapid7
- Disclosed: 2026-10-07
- CVE: CVE-2026-21589
- Write-up quality: 7/10
- Original: https://www.rapid7.com/blog/post/etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products
- Library page: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-etr-cve-2026-21589-critical-unauthenticated-arbitrary-file-access-in-atlassian-products
- Tags: domain:web impact:data-leak impact:internal-access impact:privesc kind:incident platform:threat-intel sev:critical tech:java technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:info-disclosure vuln:path-traversal

**Target:** Atlassian Data Center products (Jira, Confluence, Bitbucket, Crowd, Bamboo, Crucible, Fisheye) web-resource endpoint
**Root cause:** Double-colon (::) sequences are converted into path separators during request processing, so traversal components reach the resource-loading code and read files under the Tomcat web root.
**Steps:**
1. Identify a target file's exact name and path within the web root (no directory listing available).
2. Send a request to the web-resource handler containing `..` traversal components joined with `::` separators, e.g. `..::..::WEB-INF::classes::crowd.properties`.
3. URL-encode the payload as needed (logs may require double-decoding to detect).
4. Read the returned file contents; in a Crowd+Jira deployment, `WEB-INF/classes/crowd.properties` exposes application credentials.
**How found:** watchTowr Labs diffed vulnerable versus patched Jira, Confluence, and Bitbucket packages, spotting the web-resource handling change and hypothesizing that `::` sequences become path separators, then testing traversal payloads against the resource loader.
**Exploitation:** Unauthenticated attacker reads arbitrary files under the web root by supplying `::`-separated traversal paths to the web-resource handler. In a Crowd deployment with Jira, reading WEB-INF/classes/crowd.properties yields application credentials; with network access to Crowd those credentials create a user and add it to jira-administrators (blocked if Crowd IP allowlisting is enforced).
**Escalation:** File read of crowd.properties -> credential use against Crowd -> create user -> add to jira-administrators -> Jira admin takeover.
**Insight:** When diffing patched vs vulnerable packages, look for custom path-normalization or separator-substitution routines in resource/static handlers; unusual multi-char separators like `::` can be normalized into `/` after standard traversal filters run, bypassing them.