CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Required action (CISA's text)

Apply updates per vendor instructions.

Description (NVD)

Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

SOURCES

• CISA KEVCISA Known Exploited Vulnerabilities catalog

Other Atlassian flaws

• CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
• CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability
• CVE-2023-22527: Atlassian Confluence Data Center and Server Template Injection Vulnerability
• CVE-2023-22518: Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
• CVE-2023-22515: Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.