Reads a public web.xml through the known traversal. Advisory
Detect
Fingerprints Jira and flags CVE-2021-26086 by version.
Report
Counts checked, product, affected, and confirmed.
Targets
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Overview
This workflow finds Atlassian Jira Server and Data Center and sorts each host by whether its version falls in the CVE-2021-26086 range. Jira holds tickets, attachments, and the comments people should not have pasted. CVE-2021-26086 is path traversal on Server and Data Center. CISA listed it on KEV. Cloud is a different product and is out of this check. A below-fix 8.x build is the signal you can take to the owner. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page (title match on Jira), reads the version from /rest/api/2/serverInfo with a fallback to the root body, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. CVE-2021-26086 is on CISA KEV (known exploited). Version flag is first. Hosts in range get a second node that only reads public web.xml through the known traversal. It does not read secrets or write files.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Atlassian Jira Server and Data Center from the public page title, then GET /rest/api/2/serverInfo and parse the version. A host counts as affected only when the fingerprint matches and the version is inside the encoded range.
Confirm only those flagged hosts by reading public web.xml through the known traversal.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test. Fingerprint is read-only GET. Confirm is a GET of public web.xml, and only after the version flag.
Outputs
results.jsonl. One row per host: URL, whether Atlassian Jira Server and Data Center was detected, the version read, the affected flag, and whether the public-file confirm succeeded.
summary.json. Counts across the list: targets, product hits, affected, and errors.
Integrations
HTTP. Unauthenticated GET to the product root, /rest/api/2/serverInfo, and (on flagged hosts only) public web.xml.
Sample output
The records below are illustrative and do not come from a real run. They show one Atlassian Jira Server and Data Center host inside the CVE-2021-26086 range, one patched host, and one host that is not the product.
Which Atlassian Jira Server and Data Center versions does this flag?
before 8.5.14, 8.6.0 through 8.13.5, and 8.14.0 through 8.16.0. 8.5.14, 8.13.6, and 8.16.1 and later on those lines is the floor the graph treats as not affected. The compare uses the version the product itself served.
Does a flagged host mean CVE-2021-26086 was exploited?
No. A flagged row is patch-lag against the range table. Confirm only tries to read public web.xml. Treat a confirmed row as evidence the traversal still answers, not as proof someone already used it.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is another GET of public web.xml, only on hosts already in range. It does not log in, dump secrets, or write files.
Does the check need credentials?
No. It fingerprints the public page and reads /rest/api/2/serverInfo the way an external scanner would.
What is CVE-2021-26086?
Path traversal in Jira Server and Data Center. CISA listed it on KEV. Jira Cloud is out of scope. This workflow flags by version, then confirms with a public-file read.