CVE-2022-26138: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

CVE-2022-26138 is a hard-coded credentials weakness in the Atlassian Questions For Confluence app used with Atlassian Confluence. The credentials are exposed in plaintext, so a remote unauthenticated attacker who obtains them can log into Confluence and reach content available to members of the confluence-users group. For teams running Confluence with this app, that means unauthorized access to wiki pages and related material without needing a valid user account of their own. Confirm exact scope and fixed releases against the vendor advisory.

How it works

This issue falls under CWE-798: use of hard-coded credentials. In the Questions For Confluence app, a username and password are embedded in a way that leaves them readable in plaintext. An attacker who discovers those fixed credentials can present them to the Confluence login surface as if they were a legitimate user. Because the account is associated with the confluence-users group, successful authentication grants whatever access that group normally has—typically broad read (and possibly write) rights to spaces and pages. No further privilege escalation is required once the hard-coded pair is known; the weakness is simply that the secret is static, shared, and discoverable rather than unique and properly protected. Specifics of how the credentials appear in the app or configuration must be confirmed against the vendor advisory; do not assume file paths or packaging details beyond what Atlassian documents.

Am I affected? How to find it in your systems

Atlassian Confluence is commonly deployed as an internal knowledge base, often on-premises or in self-managed cloud instances, and the Questions For Confluence app is an optional add-on. Inventory every Confluence instance and check whether the Questions For Confluence app is installed and enabled. Review installed apps through the Confluence administration console or your configuration-management records, and compare the app version against the fixed releases listed in the vendor advisory. Because the flaw is credential-based rather than a memory-corruption bug, classic crash or exploit signatures may be absent; instead look for successful logins that use the hard-coded username (once you know it from the advisory) from unexpected source addresses, or for new sessions that appear without corresponding legitimate user activity. Authentication and access logs, plus any SIEM alerts on confluence-users group activity, are the practical telemetry sources. If you cannot identify the exact username from public detail, treat any unexplained authenticated access to confluence-users content as suspicious until you have verified the app is absent or patched.

How to remediate

Apply the updates published by Atlassian for the Questions For Confluence app exactly as directed in the vendor advisory; that is the CISA-required action and the primary fix. After patching, restart or reload the affected Confluence nodes if the advisory requires it, then verify the app version no longer matches the vulnerable builds. As hardening for this class of weakness, remove or disable any unused apps, ensure no other components ship static credentials, rotate any passwords that may have been exposed, and restrict the confluence-users group to the minimum necessary membership and permissions. Confirm post-update that the hard-coded account no longer authenticates.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls. Segment Confluence so that only trusted networks or authenticated reverse-proxy paths can reach the login interface. If a web application firewall is in place, consider rules that challenge or block authentication attempts that match the known hard-coded username once that name is obtained from the advisory. Disable the Questions For Confluence app entirely if the business can tolerate the loss of functionality; that removes the hard-coded credential surface. Increase monitoring on authentication success events and on access to sensitive spaces, and alert on any use of accounts that should not exist in your directory. These steps do not eliminate the vulnerability but shrink the window an attacker has to reuse the static credentials.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to unauthorized access and data exposure. If logs show suspicious logins or you cannot rule out use of the hard-coded credentials, treat confluence-users-accessible content as potentially viewed or copied. Review access logs, reset relevant passwords, and follow your incident-response process. You can also run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in public breach corpora.