CVE-2022-26138
Atlassian Confluence
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
What it is
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446
- nvd.nist.gov/vuln/detail/CVE-2022-26138
Description and required action as published by CISA. Full record at NVD.
Other Atlassian entries on the list
- Multiple Products Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CVE-2026-21589 · Oct 15, 2026
- Jira Server and Data Center Atlassian Jira Server and Data Center Path Traversal Vulnerability CVE-2021-26086 · Nov 12, 2024
- Confluence Data Center and Server Atlassian Confluence Data Center and Server Template Injection Vulnerability CVE-2023-22527 · Jan 24, 2024
- Confluence Data Center and Server Atlassian Confluence Data Center and Server Improper Authorization Vulnerability CVE-2023-22518 · Nov 7, 2023
- Confluence Data Center and Server Atlassian Confluence Data Center and Server Broken Access Control Vulnerability CVE-2023-22515 · Oct 5, 2023
- Bitbucket Server and Data Center Atlassian Bitbucket Server and Data Center Command Injection Vulnerability CVE-2022-36804 · Sep 30, 2022