You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

Atlassian issued an out-of-band security advisory for CVE-2026-21589, a critical pre-authentication arbitrary file read flaw affecting almost its entire Data Center product line: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye, across all versions prior to the newly released fixes. Researchers at watchTowr traced the root cause to a shared library, atlassian-plugins-webresource, where a resource-routing mechanism meant to escape slashes as double colons (::) can be abused to build path-traversal sequences and reach files inside the WEB-INF directory of any affected application. While this alone exposes configuration and server files, the researchers showed that in deployments integrated with Atlassian Crowd, reading the crowd.properties file leaks plaintext application credentials that let an attacker log into Crowd's management API directly, create a new user, and grant it administrator privileges — turning a file-read bug into full administrative takeover. Given the hundreds of thousands of internet-facing Confluence and Jira instances alone, organizations running any of the listed on-premises Atlassian products should apply the vendor's fixed versions immediately.