TLDR Tech / Practical
Atlassian products vulnerable to pre-auth arbitrary file read
A critical security flaw, CVE-2026-21589, has been identified by watchTowr Labs, enabling unauthenticated attackers to access sensitive files on Atlassian's on-premise Jira, Confluence, and Bitbucket software. The vulnerability, stemming from path traversal in web resource handling, allows unauthorized reading of files within the webroot. The researchers showed that this could be chained with default settings to extract Atlassian Crowd credentials from a specific configuration file, potentially leading to administrative control of Jira.
Read the full story