CCloud Releases
Home
Following

Cloud Releases

Service catalogues and updates come from each provider's public product listing and announcements.

Explore

  • Home
  • Latest updates
  • Following

About

  • About
  • Contact
  • Privacy Policy
  • Terms of Use

Providers

  • Amazon Web Services
  • Microsoft Azure
  • Google Cloud
  • Cloudflare

Not affiliated with any cloud provider. Product names and logos belong to their owners.

  1. Providers
  2. ›Cloudflare
  3. ›WAF
  4. ›Update

Feature•Oct 12, 2026

WAF Release - 2026-10-12

WAFCloudflare · Application security

This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.

Key Findings

  • CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.
  • CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · 50873c55387d4882aba7ea3d02751ef3 · N/A · Generic Rules - Template Injection - 2 - Beta · Disabled · Disabled · This rule is merged into the original rule "Generic Rules - Template Injection - 2" (ID: 00a9a0d663da4add95b863abd3ed0123).

Cloudflare Managed Ruleset · 22220c5e2682463daa5536214ee560b2 · N/A · TanStack - Reflected XSS - CVE:CVE-2026-102989 · N/A · Block · This is a new detection.

Cloudflare Managed Ruleset · 272b2eec72c04313a6f0da2ee919cd31 · N/A · Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 · N/A · Block · This is a new detection.

Read the original announcement↗

More from WAF

All WAF updates →

  1. WAF Release - Scheduled changes for 2026-10-19

    Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-10-12 2026-10-19 Log N/A d60e605ed36842df9ca0232f5ea9966d Broken Access Control - Directory Traversal (Beta) This rule will be merged into the original rule "Broken Access Control -…

    WAF•Feature•Oct 12, 2026

  2. Failed detections field available in Rules

    You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure.

    WAF•Feature•Oct 9, 2026

  3. Updated unsafe topic detection for AI Security for Apps

    AI Security for Apps now supports an updated set of categories for detecting unsafe topics in incoming prompts.

    WAF•Feature•Oct 7, 2026

  4. WAF Release - 2026-10-06

    This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.

    WAF•Feature•Oct 6, 2026

  5. WAF Release - 2026-10-01 - Emergency

    This update provides immediate defense against a vulnerability affecting Citrix NetScaler ADC and Gateway appliances, deploying protection against improper input validation vectors.

    WAF•Feature•Oct 1, 2026