A critical flaw in self-hosted Atlassian products can let unauthenticated attackers read sensitive application files. GajIPS detects exploitation attempts across multiple attack variants
Severity: HIGH · Priority: P2 — critical unauthenticated file read across eight Atlassian Data Center products, patch immediately
These four rules collectively detect exploitation attempts against CVE-2026-21589, a critical unauthenticated path traversal and arbitrary file read vulnerability disclosed by Atlassian on October 5, 2026, affecting eight self-hosted Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The flaw carries a CVSS v4.0 score of 9.3. An unauthenticated attacker can read any file within the web application's root directory by crafting a request with a path traversal sequence — without needing credentials or an account. The constraint is that the attacker must know the exact filename and path of the target; the flaw does not allow directory enumeration. Sensitive files that can be reached this way include configuration files, authentication tokens stored in the web root, and application credentials depending on the deployment. Atlassian's own advisory recommends deploying WAF rules targeting double-dot traversal patterns adjacent to forward slashes, backslashes, or double colons — this rule set directly implements that guidance.
A hit indicates an active path traversal attempt against a self-hosted Atlassian Data Center instance. Confirm whether the targeted product and version are among the affected releases and apply the fixed builds immediately. For Jira Software and Jira Service Management, fix versions are 9.12.40, 10.3.26, and 11.3.12; for Confluence, 9.2.26 and 10.2.19; check the advisory for Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. As an interim measure while patching, Atlassian provides product-specific rewrite.config and Tomcat RewriteValve configurations that block the traversal patterns at the application layer. Review access logs for matching traversal patterns — a successful exploitation attempt leaves a log entry with the traversal sequence, though the response body content may not be logged by default. No confirmed exploitation in the wild has been reported as of October 5–6, 2026, though no-exploit-yet status is expected to change rapidly given public disclosure.