CVE-2022-26136

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

• CWE-180
• CWE-287

• https://jira.atlassian.com/browse/BAM-21795Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/BSERV-13370Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-79476Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/CRUC-8541Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/CWD-5815Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/FE-7410Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-73897Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/JSDSERVER-11863Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/BAM-21795Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/BSERV-13370Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/CONFSERVER-79476Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/CRUC-8541Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/CWD-5815Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/FE-7410Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/JRASERVER-73897Issue Tracking, Patch, Vendor Advisory
• https://jira.atlassian.com/browse/JSDSERVER-11863Issue Tracking, Patch, Vendor Advisory

Published

Jul 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2613Use after free in Input in Google Chrome on Chrome OS prior …8.8
• CVE-2022-26130On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versi…5.3
• CVE-2022-26131Power Line Communications PLC4TRUCKS J2497 trailer receivers…9.8
• CVE-2022-26133SharedSecretClusterAuthenticator in Atlassian Bitbucket Data…9.8
• CVE-2022-26134In affected versions of Confluence Server and Data Center, a…9.8
• CVE-2022-26135A vulnerability in Mobile Plugin for Jira Data Center and Se…6.5
• CVE-2022-26137A vulnerability in multiple Atlassian products allows a remo…8.8
• CVE-2022-26138The Atlassian Questions For Confluence app for Confluence Se…9.8
• CVE-2022-2614Use after free in Sign-In Flow in Google Chrome prior to 104…8.8
• CVE-2022-26143The TP-240 (aka tp240dvr) component in Mitel MiCollab before…9.8
• CVE-2022-26144An XSS issue was discovered in MantisBT before 2.25.3. Impro…6.1
• CVE-2022-26146Tricentis qTest before 10.4 allows stored XSS by an authenti…5.4