JA EN
shiichan

Cloudflare WAF Gets Ahead of New Threats, Including an MCP Server RCE!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey there, it's Shiichan! Today's topic is security. Cloudflare's WAF just leveled up its defenses again, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published a WAF release dated April 7, 2026. It's an update that adds several new detection rules to the WAF managed rules.

This release goes after three main threats:

  • A remote code execution (RCE) vulnerability in MCP Server (CVE-2026-23744)
  • A SolarWinds authentication bypass (CVE-2025-40552)
  • XSS injection via event handlers placed in HTTP cookies

The story so far

WAF managed rules work by having Cloudflare add new detection rules on a regular cadence whenever it finds fresh vulnerabilities or attack patterns. So you don't have to write signatures yourself; a release simply lands and your coverage grows. It's great that it keeps up with newer threats too, like the MCP Server RCE that's in the news right now.

What changes

If you have the managed rules enabled, the detections for these threats start working without any extra effort on your part. Requests targeting these serious, CVE-numbered vulnerabilities get caught on the WAF side.

Dive Deep

The key detail is that each new rule ships with a different default action depending on the threat.

Shipping as Block:

  • MCP Server - Remote Code Execution - CVE-2026-23744
  • SolarWinds - Auth Bypass - CVE-2025-40552
  • XSS - OnEvents - Cookies
  • Generic Rules - Command Execution - 5 - URI

Shipping as Disabled:

  • The Body / Header variants of Generic Rules - Command Execution - 5
  • SQLi - Evasion for Body / Headers / URI
  • The SQLi - LIKE 3 and SQLi - UNION - 2 variants

Instead of blocking every new detection right away, the ones with a higher false-positive risk start on the disabled side so they can be observed first. That's a careful rollout, and if you're cautious you can tune the action to fit your environment before enabling them.

Wrap-up

  • Cloudflare's WAF managed rules gained new detection rules dated 2026-04-07
  • The main targets are an MCP Server RCE (CVE-2026-23744), a SolarWinds auth bypass (CVE-2025-40552), and cookie-based XSS
  • Serious items ship as Block, while ones prone to false positives ship as Disabled, mixing the actions

For operators using the managed rules, it's a welcome update that grows your defenses without lifting a finger. Anyone who's started touching MCP will want to check this one out!

Related posts