Path traversal in Tableau Server
Priority MEDIUM 53CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code execution.Tableau only supports product versions for 24 months after release. Older versions have reached their End of Life and are no longer supported. They are also not assessed for potential security issues and do not receive security updates.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01844 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Tableau Server | 2022.1 - 2022.1.42021.4 - 2021.4.92021.3 - 2021.3.142021.2 - 2021.2.152021.1 - 2021.1.172020.4 - 2020.4.20 | — | No fix listed | CNA |
- Tableau Server Vendor— Affected 2022.1 - 2022.1.42021.4 - 2021.4.92021.3 - 2021.3.142021.2 - 2021.2.152021.1 - 2021.1.172020.4 - 2020.4.20 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:* | 2020.4 – 2020.4.20; 2021.1 – 2021.1.17; 2021.2 – 2021.2.15; 2021.3 – 2021.3.14; 2021.4 – 2021.4.9; 2022.1 – 2022.1.4 | Vulnerable | Tableau |
- cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:* Versions 2020.4 – 2020.4.20; 2021.1 – 2021.1.17; 2021.2 – 2021.2.15; 2021.3 – 2021.3.14; 2021.4 – 2021.4.9; 2022.1 – 2022.1.4 Vulnerable ·Tableau
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22128
- 2026-10-03 Alias added: GHSA-mchj-fc27-3mfm
References
More Tableau Server vulnerabilities
- TI-2019-11732 Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or… CVSS 3.1HIGH 8.1
- TI-2019-14206 Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page. CVSS 3.1MEDIUM 6.1
- TI-2020-05599 Tableau Server installations configured with Site-Specific SAML that allows the APIs to… CVSS 3.1CRITICAL 9.8
- TI-2025-19441 Type confusion in Salesforce Tableau Server, Tableau Desktop CVSS 3.1CRITICAL 9.3
- TI-2025-32580 Path traversal in Salesforce Tableau Server CVSS 3.1HIGH 8.5
- TI-2025-32577 Unrestricted file upload in Salesforce Tableau Server CVSS 3.1HIGH 8.5
Sources
- CVE-2022-22128 · CVE Program
- CVE-2022-22128 · NVD
- FIRST EPSS
- GHSA-mchj-fc27-3mfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences