JA EN
shiichan

WAF Release 2026-10-12: New Rules for TanStack and Atlassian Vulnerabilities

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#web

Hi everyone, it's Shii-chan!

Cloudflare Changelog developers.cloudflare.com

Today I read through the WAF release notes!

What was announced?

The Cloudflare Changelog published the 2026-10-12 WAF release. It adds new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.

Why it matters

Published vulnerabilities can be exploited quickly. Being protected at the WAF buys you time before application fixes land.

What changes

Two new detections were added, both with the Block action.

  • CVE-2026-102989: a reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can inject malicious scripts into pages viewed by other users, potentially leading to session hijacking or unauthorized actions
  • CVE-2026-21589: an arbitrary file access vulnerability affecting Atlassian products. Attackers can read unauthorized files on the target system, risking exposure of sensitive configuration data

Dive Deep

The rules are in the Cloudflare Managed Ruleset.

  • TanStack - Reflected XSS (rule ID ending 4ee560b2): new, Block
  • Atlassian - Arbitrary File Access (rule ID ending e919cd31): new, Block
  • Generic Rules - Template Injection - 2 - Beta (rule ID ending 02751ef3): stays disabled; merged into the original "Generic Rules - Template Injection - 2" rule (ID ending d3ed0123)

WAF mitigation is a stopgap, so if you run the affected products, remember to apply the vendor fixes too.

Wrap-up

  • The 2026-10-12 WAF release adds two new detections
  • They cover a TanStack reflected XSS and Atlassian arbitrary file access, both set to Block
  • The Template Injection Beta rule was merged into the original rule

If you expose TanStack or Atlassian products, this one's for you!

Related posts