CVE-2026-21589: 
Bamboo Analisi e mitigazione delle vulnerabilità

CVE-2026-21589 is a critical Arbitrary File Access (path traversal) vulnerability affecting eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. An unauthenticated remote attacker can read specific files within the web application root directory without authentication, provided they know the exact file name and path. The vulnerability does not permit directory enumeration. It was published on October 5, 2026, with patches and a GitHub Advisory released on October 6, 2026. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Atlassian Advisory).

Affected version ranges:

• Bitbucket Data Center: >= 4.6.0; fix versions: 9.4.26, 10.2.8, 10.5.1
• Confluence Data Center: >= 5.10.0; fix versions: 9.2.26, 10.2.19
• Crowd Data Center: >= 2.11.0; fix versions: 6.3.7, 7.0.3, 7.1.7, 7.2.4
• Jira Software Data Center: >= 7.1.0; fix versions: 9.12.40, 10.3.26, 11.3.12
• Jira Service Management Data Center: >= 3.1.0; fix versions: 5.12.40, 10.3.26, 11.3.12
• Bamboo Data Center: >= 7.0.1; fix versions: 10.2.24, 12.1.12
• Crucible / Fisheye: fix version: 4.9.15

The vulnerability is classified as CWE-552 (Files or Directories Accessible to External Parties), with an estimated CWE-22 (Path Traversal) root cause. The flaw resides in the Atlassian webresource router, which fails to properly sanitize URL-encoded path traversal sequences. Specifically, the router does not correctly handle the ..%3a%3a sequence (where %3a is the URL-encoded colon :), allowing attackers to escape the intended web resource anchor directory and traverse up to the web application root. By constructing a crafted HTTP GET request to endpoints such as /download/resources/ or /resources/ with a product-specific anchor (e.g., jira.webresources:color-picker-popup/images/) followed by repeated ..%3a%3a traversal segments, an attacker can read arbitrary files within the webapp root. No authentication, user interaction, or special network position is required — only knowledge of the target file's exact path (GitHub Advisory, watchTowr Labs, Rapid7 ETR).

Successful exploitation allows unauthenticated attackers to read sensitive files within the web application root, including WEB-INF/web.xml, WEB-INF/classes/seraph-config.xml, database properties files, and other configuration files containing database credentials, API keys, JWT tokens, AWS access keys, and private key material. Exposure of these credentials enables significant downstream attacks: direct database access, lateral movement to connected systems, privilege escalation (e.g., creating Jira admin accounts), and potential full application compromise. The vulnerability affects all eight products simultaneously in many enterprise environments, dramatically expanding the attack surface. While the vulnerability itself does not provide code execution, the credentials and configuration data it exposes can readily enable follow-on RCE or full infrastructure compromise (GitHub Advisory, watchTowr Labs, Rapid7 ETR).

Multiple public PoC exploits were released within hours of disclosure on October 6, 2026. The watchTowr Labs detection script (watchTowr GitHub) identifies vulnerable instances, while a full exploit (tc4dy/CVE-2026-21589-PoC-Exploit) implements unauthenticated arbitrary file read with credential harvesting from WEB-INF config files using ..%3a%3a path traversal payloads. Active exploitation in the wild was confirmed within hours of PoC publication, with SANS ISC reporting active scanning on October 7, 2026 (SANS ISC). BleepingComputer and multiple threat intelligence sources confirmed active exploitation (BleepingComputer). The EPSS score is approximately 2.78% (86th percentile). No specific threat actor attribution has been publicly confirmed. The CVE status is currently "Awaiting Analysis" and CISA KEV catalog status is not confirmed in available data.

1. Reconnaissance: Identify internet-facing Atlassian Data Center instances (Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye) using tools like Shodan, Censys, or LeakIX. Confirm the product type and version by probing known endpoints.

2. Determine product anchor and traversal depth: Each product uses a specific webresource anchor path. For Jira, the anchor is jira.webresources:color-picker-popup/images/ (depth 5); for Confluence, a different anchor with depth 9; for Bitbucket, depth 6. The traversal depth must match the number of directory levels in the anchor path.

3. Construct the path traversal payload: Build the malicious URL using the pattern:

GET /download/resources/{ANCHOR}..%3a%3a..%3a%3a..%3a%3a..%3a%3a..%3a%3aWEB-INF/web.xml HTTP/1.1

For Jira with depth 5, the full path becomes:

/download/resources/jira.webresources:color-picker-popup/images/..%3a%3a..%3a%3a..%3a%3a..%3a%3a..%3a%3aWEB-INF/web.xml

The %3a (URL-encoded colon) bypasses path normalization filters that block standard ../ sequences.

4. Send unauthenticated HTTP GET request: Issue the request with no authentication headers or session cookies. SSL verification can be disabled. A minimal User-Agent header is sufficient:

GET /download/resources/jira.webresources:color-picker-popup/images/..%3a%3a..%3a%3a..%3a%3a..%3a%3a..%3a%3aWEB-INF/web.xml HTTP/1.1
Host: target.example.com
User-Agent: Mozilla/5.0
Accept: */*

5. Validate the response: An HTTP 200 response with XML content containing <web-app or <?xml confirms successful file read. HTTP 404 indicates the target is patched; HTTP 500 suggests correct traversal syntax but wrong file path.

6. Iterate over sensitive files: Repeat steps 3–5 for additional high-value targets: WEB-INF/urlrewrite.xml, WEB-INF/classes/seraph-config.xml, WEB-INF/classes/database.properties, and other configuration files.

7. Extract credentials: Parse the retrieved file contents for JDBC URLs, database usernames/passwords, API keys, JWT tokens, AWS access keys (AKIA*), and private key headers (-----BEGIN PRIVATE KEY-----).

8. Chain to further compromise: Use harvested database credentials for direct DB access, API keys for lateral movement, or application credentials to create administrative accounts (e.g., Jira admin) for persistent access (watchTowr Labs, GitHub Advisory).

• Network: Unusual HTTP GET requests to /download/resources/, /resources/, /s/1/_/download/, /contextbatch/js/, or /contextbatch/css/ endpoints containing ..%3a%3a or %3a%3a sequences in the URL path; high volume of requests to these endpoints from a single IP; outbound connections from Atlassian servers to unknown external IPs following file access.
• Web Server / Access Logs: Access log entries showing requests matching patterns like *..%3a%3a*WEB-INF* or *%3a%3a*web.xml*; HTTP 200 responses to requests targeting WEB-INF/web.xml, seraph-config.xml, or database.properties; requests with User-Agent strings such as CVE-2026-21589-check, Mozilla/5.0 with no referrer to sensitive resource paths.
• File System: No direct file system artifacts from this read-only vulnerability; however, subsequent exploitation may create new admin accounts, web shells, or modified configuration files.
• Application Logs: Atlassian application logs showing unexpected access to internal configuration resources; authentication events for newly created administrative accounts with no corresponding legitimate provisioning activity.
• Scanning Indicators: Rapid sequential probing of multiple Atlassian product endpoints (/download/resources/, /resources/) from the same source IP, consistent with automated scanning tools (SANS ISC, watchTowr GitHub).

Atlassian has released patched versions for all affected products. Organizations should upgrade to the following fixed versions as the primary remediation:

• Bitbucket Data Center: 9.4.26, 10.2.8, or 10.5.1
• Confluence Data Center: 9.2.26 or 10.2.19
• Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, or 7.2.4
• Jira Software Data Center: 9.12.40, 10.3.26, or 11.3.12
• Jira Service Management Data Center: 5.12.40, 10.3.26, or 11.3.12
• Bamboo Data Center: 10.2.24 or 12.1.12
• Crucible / Fisheye: 4.9.15

As interim mitigations where immediate patching is not possible: implement WAF rules to block requests containing %3a%3a or ..%3a%3a sequences in URL paths; restrict network-level access to Atlassian instances to trusted IP ranges; review and harden file system permissions on sensitive configuration files in the web application root; monitor access logs for exploitation indicators. Rotate any credentials stored in WEB-INF configuration files if exploitation cannot be ruled out (Atlassian Advisory, GitHub Advisory, Rapid7 ETR).

The vulnerability generated significant industry attention, with active exploitation confirmed within hours of PoC publication on October 7, 2026. BleepingComputer reported that hackers began exploiting the flaw immediately after public PoC release (BleepingComputer). watchTowr Labs published a detailed technical write-up and FAQ, noting the vulnerability's broad impact across eight enterprise products and its potential to enable credential theft and admin account creation (watchTowr Labs). SANS ISC documented active scanning activity beginning October 7, 2026 (SANS ISC). Government CERTs including Canada's CCCS, Ireland's NCSC, and CERT-EU issued advisories urging immediate patching. Security researchers on Mastodon, Bluesky, and Reddit widely shared the watchTowr write-up, with the r/netsec and r/blueteamsec communities highlighting the severity and speed of exploitation. CSO Online and InfoWorld characterized the flaw as turning "eight enterprise products into one big security problem." CrowdSec published a vulntracking report confirming ongoing exploitation of Jira and Confluence instances.