NewsEditorialSource: Cloudflare
Cloudflare adds WAF detections for TanStack XSS and Atlassian file-access flaws
Cloudflare announced two new blocking detections in its web application firewall (WAF) Managed Ruleset on October 12, 2026, targeting TanStack and Atlassian vulnerabilities. Its search-indexed release note lists reflected cross-site scripting (XSS) in TanStack, CVE-2026-102989, and unauthorized file access in Atlassian products, CVE-2026-21589. TanStack says its Start flaw can return attacker-controlled HTML from an application's origin when a victim opens a crafted link. BleepingComputer reported that the Atlassian flaw lets unauthenticated attackers access specific files within the web application root if they know the exact path and filename.
Why it matters
Developers running affected TanStack Start applications or self-hosted Atlassian products should verify that the relevant managed rules are enabled and blocking, then complete application upgrades. TanStack says edge mitigations do not replace its fix; Atlassian fixes vary by product and release branch. Cloudflare's announcement was verified only through search-indexed text, which does not establish rollout completion, plan eligibility or protection against every exploit variant.
Attribution
Sources
- CloudflareWAF Release - 2026-10-12Source published (UTC)
- BleepingComputerAtlassian warns of critical file-access flaw in Jira, ConfluenceSource published (UTC)
- TanStackTanStack Start security update: CVE-2026-102989Source published (UTC)
Read the original source for full details and context.