Summary of Vulnerability

All Crowd Data Center versions are affected by this vulnerability.
This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be sensitive files present that increase your risk.

Crowd Data Center versions as listed below are at risk and require immediate attention. See ‘What You Need to Do’ for detailed instructions.

This critical severity Arbitrary File Access vulnerability known as CVE-2026-21589 affects all versions prior to the listed fix versions of Crowd Data Center. Versions outside of the support window (i.e. versions that have reached End of Life) may also be affected, so Atlassian recommends you upgrade to a fixed LTS version or later.

Affected Versions

Fixed Versions

What You Need to Do

Immediately patch to a fixed version

Atlassian recommends that you upgrade your instance to one of the versions listed in the “Fixed Versions” table section of this ticket. For full descriptions of the above versions of Crowd Data Center, see the release notes. You can download the latest version of Crowd Data Center from the download center.

Apply temporary mitigations if unable to patch

Remove your instance from the internet until you can patch or apply mitigations, if possible. Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can take action.

Option 1: Apply a Web Application Firewall Rule, requires regex filtering

Apply a rule, described below, to your Web Application Firewall or proxy layer. Rule implementation instructions are dependent on your technology (e.g. reverse proxy, AWS WAF, or Cloudflare).

1. Block any URL containing this regex pattern

   (?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*
   

   The intent of this regex is to block .. immediately adjacent to /, \, or ::.

2. Test that your rule blocks .. immediately adjacent to \, /, or :: and handles the URL-encoded patterns

Option 2: Block requests using Tomcat’s RewriteValve

First, back up your instance. Then, for each node in your Data Center cluster:

1. Shut down the node
2. Enable Tomcat’s RewriteValve:
   1. Locate the server.xml file:
      1. On Crowd, either apache-tomcat/conf/Catalina/localhost/crowd.xml or apache-tomcat/conf/server.xml, whichever has your application <Context> (see below)
   2. Make a copy of this file as a backup
   3. Inside this file identify the <Context> element representing the application, the docBase attribute will be a path including the product name; in the standard setup this will be the only <Context> element
   4. Add the following line within that element if it is not already there:
      <Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />
3. Install the configuration:
   1. Locate the WEB-INF  directory:
      1. On Crowd: crowd-webapp/WEB-INF 
   2. Within the directory, check if the file rewrite.config exists
   3. If it exists:
      1. Make a copy of the existing rewrite.config file as a backup
      2. Append the existing file with the content of rewrite.config
   4. If it does not exist:
      1. Put attached rewrite.config   file in the directory
4. Restart the node

Note: These mitigation actions are limited and not a replacement for patching your instance; you must patch as soon as possible