The Confluence app that shipped with a password
Installing one Atlassian app created an account with a fixed password, and that password is now public. Check yours.
Last week Atlassian warned that its Questions for Confluence app, when installed on Confluence Server or Data Center, creates a user called disabledsystemuser with a hardcoded password. Days later the password was posted publicly. Anyone who knows it can log in and read what that account can see.
If you use the app, follow Atlassian’s advisory: update the app, and disable or delete that account. Removing the app alone isn’t enough; the account stays.
The wider lesson: vendors still ship hidden or fixed accounts, in apps, appliances, cameras and routers. Ways to catch them:
- Review user lists after installing anything, especially plugins and add-ons. Look for accounts nobody created.
- Check service and system accounts regularly, not only people.
- Limit what any single account can see, so a leaked one exposes less.
- For your own code: no default passwords. Force a unique one at setup.
A password that ships with the product is a password the whole internet will know eventually.