WAF - WAF Release - 2026-10-12

<p>This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.</p> <p><strong>Key Findings</strong></p> <ul> <li> <p>CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.</p> </li> <li> <p>CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.</p> </li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="50873c55387d4882aba7ea3d02751ef3"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 50873c55387d4882aba7ea3d02751ef3" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...02751ef3</span></button></span></td><td>N/A</td><td>Generic Rules - Template Injection - 2 - Beta</td><td>Disabled</td><td>Disabled</td><td>This rule is merged into the original rule &quot;Generic Rules - Template Injection - 2&quot; (ID: <span class="rule-id" data-rule-id="00a9a0d663da4add95b863abd3ed0123"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 00a9a0d663da4add95b863abd3ed0123" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...d3ed0123</span></button></span>).</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="22220c5e2682463daa5536214ee560b2"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 22220c5e2682463daa5536214ee560b2" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...4ee560b2</span></button></span></td><td>N/A</td><td>TanStack - Reflected XSS - CVE:CVE-2026-102989</td><td>N/A</td><td>Block</td><td>This is a new detection.</td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="272b2eec72c04313a6f0da2ee919cd31"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 272b2eec72c04313a6f0da2ee919cd31" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...e919cd31</span></button></span></td><td>N/A</td><td>Atlassian - Arbitrary File Access - CVE:CVE-2026-21589</td><td>N/A</td><td>Block</td><td>This is a new detection.</td></tr></tbody></table>