SB2026091637 - Multiple vulnerabilities in Confluence Data Center
Published: September 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-55276)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to obtain incomplete security configuration information.
The vulnerability exists due to logic errors in effective web.xml generation in the logged effective web.xml output when generating configuration logs. A local user can review the logged output to obtain incomplete security configuration information.
Special roles and empty authorization constraints are omitted from the logged effective web.xml.
2) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53404)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass rewrite conditions.
The vulnerability exists due to logic errors in RewriteValve when processing requests against OR-chained rewrite conditions. A remote attacker can send a request that matches the first OR condition to bypass rewrite conditions.
Exploitation requires a rule set that uses an OR chain followed by non-OR conditions.
3) Uncontrolled Recursion (CVE-ID: CVE-2026-73566)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the mapHas helper used by filesFilter when processing a crafted tar archive with a non-empty member-selection list. A remote attacker can supply a specially crafted archive with a long path to cause a denial of service.
On async and streaming consumers, the resulting stack overflow raises an uncaught RangeError that terminates the Node process. The issue is triggered when listing or extracting selected members from an untrusted archive.
4) Integer overflow (CVE-ID: CVE-2026-73086)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to predict generated identifiers and bypass authentication.
The vulnerability exists due to integer overflow or wraparound in the nanoid(size) function when processing a user-controlled size parameter. A remote attacker can submit a size value of at least 2^31 to corrupt the process-wide CSPRNG pool and predict subsequently generated tokens.
The issue affects all consumers of nanoid in the same process until the process restarts or the pool offset wraps back to a positive value.
Remediation
Install update from vendor's website.