Cloudflare WAF 2026-10-12：新增 TanStack XSS
WAF - WAF Release - 2026-10-12
推荐理由
涉及两个可被外部利用的高危漏洞修复，直接影响线上安全。建议立即检查 WAF 规则状态，确保 TanStack 和 Atlassian 相关的新增 Block 规则已生效，以防范即时攻击风险。
This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.
本次发布引入了新的检测规则，以缓解影响 TanStack 和 Atlassian 产品的近期漏洞。
Key Findings
主要发现
- CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.
- CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.
- CVE-2026-102989：一种影响 TanStack 的反射型跨站脚本（XSS）漏洞。未经身份验证的攻击者可以利用此缺陷向其他用户查看的网页中注入恶意脚本，可能导致会话劫持或执行未授权操作。
- CVE-2026-21589：一种影响 Atlassian 产品的任意文件访问漏洞。威胁行为者可利用此缺陷读取目标系统上的未授权文件，从而导致敏感配置数据泄露的风险。
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule "Generic Rules - Template Injection - 2" (ID: ...d3ed0123). |
| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |
| 规则集 | 规则 ID | 旧版规则 ID | 描述 | 先前操作 | 新操作 | 备注 |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...02751ef3 | N/A | 通用规则 - 模板注入 - 2 - Beta | 已禁用 | 已禁用 | 此规则已合并到原始规则“通用规则 - 模板注入 - 2”（ID: ...d3ed0123）中。 |
| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - 反射型 XSS - CVE:CVE-2026-102989 | N/A | 阻止 | 这是一项新的检测。 |
| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - 任意文件访问 - CVE:CVE-2026-21589 | N/A | 阻止 | 这是一项新的检测。 |
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力