CVE-2025-26495

Salesforce Tableau Server is vulnerable to a Cleartext Storage of Sensitive Information (CWE-312) issue where Personal Access Tokens (PAT) can be recorded into logging repositories. This vulnerability affects Tableau Server versions prior to 2022.1.3 , 2021.4.8 , 2021.3.13 , 2021.2.14 , 2021.1.16...

CVE-2019-15637

Numerous Tableau products, including Tableau Server , Tableau Desktop , Tableau Reader , and Tableau Public Desktop , are vulnerable to an XML External Entity (XXE) injection. The vulnerability can be triggered through a malicious workbook , extension , or data source , potentially leading to inf...

CVE-2021-1629

Tableau Server (Tableau Server) is affected by CVE-2021-1629, an open redirect vulnerability arising from the server’s inability to validate certain URLs embedded in emails sent to users. This could allow an attacker to redirect a user to a malicious site via a link in a shared/view email. The is...

CVE-2025-26494

Salesforce Tableau Server versions 2023.3 through 2023.3.5 are affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This flaw can lead to an Authentication Bypass , potentially allowing an attacker to circumvent security mechanisms and gain unauthorized access to the system. ...

CVE-2019-19719

CVE-2019-19719 affects Tableau Server 10.3–2019.4 on Windows and Linux. The vulnerability is an XSS flaw exposed via the embeddedAuthRedirect page, as documented in Red Hat, OpenVAS, and CVE entries. The issue stems from improper handling on the embeddedAuthRedirect flow, enabling cross-site scri...

CVE-2020-6939

CVE-2020-6939 affects Tableau Server installations with Site-Specific SAML and allows the APIs to be used by unauthenticated users. The vulnerability could enable an attacker to configure Site-Specific SAML settings and potentially take over user accounts on the affected site. Affected versions o...

CVE-2022-22127

Tableau Server (Local Identity Store) is affected by a broken access control vulnerability (CVE-2022-22127). A malicious site administrator can change passwords for users across different sites hosted on the same Tableau Server, enabling unauthorized access to data. Affected versions include 2020...

CVE-2025-52452

A Path Traversal vulnerability exists in Salesforce Tableau Server on Windows and Linux operating systems. The flaw is located within the tabdoc api - duplicate-data-source modules , where incorrect restrictions on pathnames to the restricted-access catalog allow for Absolute Path Traversal . A m...

CVE-2025-26496

Salesforce Tableau Server and Tableau Desktop on Windows and Linux are vulnerable to a Type Confusion vulnerability within the File Upload modules . This flaw allows for Local Code Inclusion , potentially enabling attackers to upload and execute malicious files. The issue affects versions prior t...

CVE-2022-22128

CVE-2022-22128 describes a path traversal vulnerability in Tableau Server’s Administration Agent internal file transfer service that could allow a remote attacker to execute arbitrary code. Affected component: Tableau Server Administration Agent’s file transfer service. Root cause: path traversal...

CVE-2025-52446

A vulnerability in the tab-doc api modules of Salesforce Tableau Server on Windows and Linux allows an authorization bypass via a user-controlled key. This flaw enables interface manipulation , potentially granting unauthorized access to the production database cluster. This issue impacts Tableau...

CVE-2025-52448

Salesforce Tableau Server is vulnerable to an authorization bypass via a user-controlled key within the validate-initial-sql API modules. This vulnerability allows an attacker to perform interface manipulation , potentially gaining unauthorized access to the production database cluster. The issue...

CVE-2020-6938

CVE-2020-6938 affects Tableau Server (versions 10.5, 2018.x, 2019.x, 2020.x released before 26 June 2020). The vulnerability allows access to sensitive information present in log files. The connected documents do not provide concrete technical details such as the exact vulnerable component, root ...

CVE-2025-52447

The Salesforce Tableau Server (Windows, Linux) is affected by an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) in the set-initial-sql tabdoc command modules. This flaw allows an attacker, operating remotely, to bypass authentication and gain unauthorized access to prote...

CVE-2025-52455

A Server-Side Request Forgery (SSRF) vulnerability exists in the EPS Server modules of Salesforce Tableau Server on Windows and Linux platforms. The root cause is the insufficient validation of requests on the server side, which allows a remote attacker to perform an SSRF attack resulting in Reso...

CVE-2025-26497

Salesforce Tableau Server on Windows and Linux is vulnerable to an Unrestricted Upload of File with Dangerous Type vulnerability within the Flow Editor modules . This flaw allows an attacker to perform Absolute Path Traversal , potentially enabling the upload of files with dangerous types. The is...

CVE-2025-52453

A Server-Side Request Forgery (SSRF) vulnerability exists in the Flow Data Source modules of Salesforce Tableau Server running on Windows and Linux. The root cause is insufficient validation of queries on the server side, which allows an attacker to perform an SSRF attack and achieve Resource Loc...

CVE-2025-52449

A vulnerability in Salesforce Tableau Server (Windows and Linux) on versions prior to 2025.1.3 , prior to 2024.2.12 , and prior to 2023.3.19 allows for unrestricted upload of dangerous file types . The root cause is insufficient file type validation within the Extensible Protocol Service modules ...

CVE-2025-52454

A Server-Side Request Forgery (SSRF) vulnerability exists in Salesforce Tableau Server on Windows and Linux systems. The issue is caused by insufficient validation of queries within the Amazon S3 Connector modules , which allows for Resource Location Spoofing . This vulnerability affects Tableau ...

CVE-2025-26498

Salesforce Tableau Server is vulnerable to an Unrestricted Upload of File with Dangerous Type vulnerability affecting versions prior to 2025.1.3 , 2024.2.12 , and 2023.3.19 on both Windows and Linux platforms. The root cause lies in the establish-connection-no-undo modules, which allow for Absolu...

CVE-2025-52451

Salesforce Tableau Server on Windows and Linux is vulnerable to an Absolute Path Traversal flaw due to improper input validation in the tabdoc api - create-data-source-from-file-upload modules. This issue affects versions prior to 2025.1.3 , 2024.2.12 , and 2023.3.19 . To remediate this vulnerabi...

CVE-2025-52450

Salesforce Tableau Server on Windows and Linux is vulnerable to an Absolute Path Traversal vulnerability (CWE-22) within the abdoc api - create-data-source-from-file-upload modules. This issue is caused by the improper limitation of a pathname to a restricted directory . Affected versions include...