CVE-2022-26138VulnerabilityPublished 07/29/2022Updated 10/24/2026

CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Affects Atlassian ConfluenceSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 07/29/2022
KEV deadline: 08/19/2022
EPSS: 98.2% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

The Atlassian Questions For Confluence App contains hard-coded credentials that expose a username and password in plaintext. This vulnerability allows a remote unauthenticated attacker to use these credentials to log into Confluence and access all content available to users in the confluence-users group. The issue is classified as high severity and has been exploited in the wild. No specific affected versions or patch information is provided.

Summary

CVE-2022-26138 describes a vulnerability in the Atlassian Questions For Confluence App where hard-coded credentials are embedded in the application. These credentials are exposed in plaintext, enabling remote unauthenticated attackers to log into Confluence with the privileges of the confluence-users group. This vulnerability compromises the confidentiality of content accessible to these users. The vulnerability is known to be exploited in the wild, indicating active threat usage. No patch or remediation details are provided in the available data.

Impact

An attacker can remotely authenticate to Confluence using the hard-coded credentials, gaining access to all content accessible by the confluence-users group. This leads to unauthorized disclosure of potentially sensitive information within Confluence. The vulnerability has been exploited in the wild, confirming active risk to affected deployments.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting network access to Confluence, monitoring for suspicious login activity, and reviewing application configurations to mitigate exposure. Avoid relying solely on the affected app until a fix or workaround is provided by Atlassian.

Weaknesses

CWE-798Hard-coded Credentials (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 12:05:32 UTC

Weaknesses

References

Related threats