WAF adds detections for TanStack XSS and Atlassian file access vulnerabilities
Cloudflare WAF now includes new detections to block CVE-2026-102989 (TanStack reflected XSS) and CVE-2026-21589 (Atlassian arbitrary file access). These rules protect against recent vulnerabilities that could lead to session hijacking or unauthorized data exposure.
This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.
Key Findings
-
CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.
-
CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule "Generic Rules - Template Injection - 2" (ID: ...d3ed0123). |
| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Persistent browser tool in Agents SDK with tabs and logins
The Cloudflare Agents SDK now includes a browserTool that allows agents to maintain a persistent browser session across multiple turns, preserving tabs, cookies, and login sessions. The browser remains alive even when the Durable Object hibernates, with a 10-minute idle timeout before creating a fresh session.
Cloudflare API MCP server sends Workers Issues as MCP Events
The Cloudflare API MCP server now exposes Workers Issues as MCP Events through webhook subscriptions, allowing agents to receive real-time notifications when production failures are detected without polling. Clients can subscribe to cloudflare.alert.workers_observability_real_time_issue scoped to an account or individual Worker.
Web Analytics: Deeper Core Web Vitals Diagnostics with LCP & INP Sub-Part Metrics
Real User Monitoring in Web Analytics now breaks down Largest Contentful Paint (LCP) and Interaction to Next Paint (INP) into their constituent phases, plus splits connection time into TCP and TLS components. These sub-part metrics are available in the dashboard and queryable through the GraphQL Analytics API to help identify which specific area is impacting page performance.