WAF adds detections for TanStack XSS and Atlassian file access vulnerabilities
Cloudflare WAF now includes new detections to block CVE-2026-102989 (TanStack reflected XSS) and CVE-2026-21589 (Atlassian arbitrary file access). These rules protect against recent vulnerabilities that could lead to session hijacking or unauthorized data exposure.
This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.
Key Findings
-
CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.
-
CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule "Generic Rules - Template Injection - 2" (ID: ...d3ed0123). |
| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Cloudflare One Client for Windows - Hotfix for split tunnel disconnections
This release resolves an issue where the Windows Cloudflare One Client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply.
Cloudflare One Client for macOS - Split tunnel hostname fix
This hotfix resolves an issue where the Cloudflare One Client for macOS would repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply.
Cloudflare One Client for Linux - Split tunnel hostname configuration fix
Fixed an issue where the Linux client would repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply, improving stability for users with complex tunnel setups.