ZeroDay Findings
Sign inSign up

Findings

CVE-2022-26138

Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

Published Jul 20, 2022 · updated Jun 16, 2026 · atlassian questions for confluence

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 20, 2022 · Catalog

    Detected

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group.

  2. Jul 29, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Aug 19, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group.

Required action

Apply updates per vendor instructions.

CISA due date Aug 19, 2022

Affected

  • cpe atlassian/questions for confluence2.7.34
  • cpe atlassian/questions for confluence2.7.35
  • cpe atlassian/questions for confluence3.0.2
  • vendor Atlassian Confluenceversion unspecified

Sources

  • CISA KEVCVE-2022-26138

    Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

    cisa.gov
  • CVE.orgCVE-2022-26138

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-26138

    30-day exploitation probability 98.2%

    first.org
  • NIST NVDCVE-2022-26138

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded passw

    nvd.nist.gov

References