CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
Description
CVE-2022-26138 is a hard-coded credentials vulnerability in the Atlassian Questions For Confluence app that exposes a username and password in plaintext within the application. A remote unauthenticated attacker can use these hard-coded credentials to log into Confluence and access all content accessible to users in the confluence-users group. CISA has added CVE-2022-26138 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.3% (99.9th percentile), this vulnerability has one of the highest exploitation probabilities among all tracked CVEs.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | questions for confluence | 2.7.34; 2.7.35; 3.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://confluence.atlassian.com/doc/confluence-security-advisory-2022-07-20-1142446709.html(Vendor Advisory)
- https://jira.atlassian.com/browse/CONFSERVER-79483(Issue Tracking, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26138(US Government Resource)
Weakness Type
CWE-798: Use of Hard-coded Credentials
CVE-2022-26138 is a textbook example of hard-coded credentials (CWE-798) in the Atlassian Questions For Confluence app. The application ships with a preconfigured user account that has a known username and password embedded directly in the software. Any attacker who knows these credentials — which have been publicly disclosed — can authenticate to any Confluence instance running the vulnerable app version and gain access to all content available to the confluence-users group.
Learn more: CWE-798 — Use of Hard-coded Credentials
Impact Analysis
CVE-2022-26138 poses an extreme risk to Confluence environments because the hard-coded credentials are shared across all installations of the Questions For Confluence app, meaning every affected instance is vulnerable to the same credential pair. The attack requires no special skills — an attacker simply needs to know the publicly disclosed username and password and use them to log into the Confluence web interface. Once authenticated, the attacker has access to all content available to the confluence-users group, which typically includes wikis, documentation, internal knowledge bases, and potentially sensitive corporate information. Confidentiality is severely impacted as all accessible Confluence content can be read; integrity is at risk as the attacker can modify pages and create content; and availability could be disrupted through content deletion or system manipulation. The EPSS score of 94.3% (99.9th percentile) confirms near-certain exploitation in exposed environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-26138 in the wild by adding it to the Known Exploited Vulnerabilities catalog on July 29, 2022, with a remediation deadline of August 19, 2022. The EPSS score of 94.3% (99.9th percentile) places this among the most actively exploited vulnerabilities globally. The hard-coded credentials have been publicly disclosed, meaning any attacker can exploit this vulnerability against any unpatched Confluence instance with no technical skill required beyond entering a username and password. This trivial exploitation path has led to widespread automated scanning and compromise attempts against internet-facing Confluence deployments.
Remediation
- Update or uninstall the Questions For Confluence app: Apply the updated version of the app as referenced in the Atlassian security advisory, or uninstall the Questions For Confluence app entirely if it is not required.
- Disable or delete the hard-coded user account: Even after updating the app, verify that the hard-coded user account has been disabled or removed. Check Confluence's user management for the account and remove it if present.
- Audit Confluence access logs for unauthorized access: Review authentication logs for any logins using the hard-coded credentials, which would indicate prior exploitation. Investigate any content accessed or modified by the compromised account.
- Restrict Confluence access to trusted networks: Implement network-level access controls to prevent unauthorized access to the Confluence web interface from the internet, reducing the attack surface for credential-based attacks.
- Review and audit all Confluence apps for security vulnerabilities: Conduct a comprehensive review of all installed Confluence plugins and apps to identify any other instances of hard-coded credentials or security misconfigurations.
Technical Details
CVE-2022-26138 is a hard-coded credentials vulnerability in the Atlassian Questions For Confluence app. When installed, the app creates a Confluence user account with a predetermined username and password that is identical across all installations. These credentials are embedded in the application code and have been publicly disclosed, making them known to any potential attacker. The account is typically configured as a member of the confluence-users group, which grants broad read and write access to Confluence spaces and pages. The attack is trivially simple: the attacker navigates to the Confluence login page, enters the known username and password, and gains immediate access to the system. No exploitation tools, technical knowledge, or vulnerability research is required. The vulnerability is particularly impactful because Confluence is commonly used as an enterprise knowledge management platform containing sensitive internal documentation, project plans, technical specifications, and credentials for other systems.
Frequently Asked Questions
Is CVE-2022-26138 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-26138 by adding it to the Known Exploited Vulnerabilities catalog. The hard-coded credentials have been publicly disclosed, and the EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation. Any Confluence instance with the vulnerable Questions For Confluence app should be considered at immediate risk.
What products are affected by CVE-2022-26138?
CVE-2022-26138 affects Atlassian Confluence instances running the Questions For Confluence app. The vulnerability is in the app itself, not the core Confluence product. Confluence instances without the Questions For Confluence app installed are not affected.
How do I fix CVE-2022-26138?
Update the Questions For Confluence app to the patched version as specified in the Atlassian security advisory, or uninstall the app entirely. After updating, verify that the hard-coded user account has been removed from Confluence user management. Audit access logs for any unauthorized logins using the known credentials.
How severe is CVE-2022-26138?
CVE-2022-26138 is an extremely severe vulnerability with an EPSS score of 94.3% (99.9th percentile). The publicly known hard-coded credentials allow any attacker to log into affected Confluence instances with zero technical skill required. This provides immediate access to all content in the confluence-users group, which typically includes sensitive corporate information.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.