Spotfire OAuth2 PKCE Bypass for public clients
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules). This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Spotfire | Spotfire Enterprise | up to 14.0.12; up to 14.4.2; up to 14.5.0; up to 14.6.1; up to 14.6.2; up to 14.7.0; up to 14.8.0 | — | No fix listed | CNA |
| Spotfire | Spotfire Enterprise with External Consumers | up to 14.0.12; up to 14.5.0; up to 14.6.0; up to 14.6.1; up to 14.6.2; up to 14.7.0; up to 14.8.0 | — | No fix listed | CNA |
| Spotfire | Spotfire on Kubernetes | up to 4.2.0; 5.0.x and later; 6.0.x and later | — | No fix listed | CNA |
- Spotfire Enterprise VendorSpotfire Affected up to 14.0.12; up to 14.4.2; up to 14.5.0; up to 14.6.1; up to 14.6.2; up to 14.7.0; up to 14.8.0 Fixed in — No fix listed CNA
- Spotfire Enterprise with External Consumers VendorSpotfire Affected up to 14.0.12; up to 14.5.0; up to 14.6.0; up to 14.6.1; up to 14.6.2; up to 14.7.0; up to 14.8.0 Fixed in — No fix listed CNA
- Spotfire on Kubernetes VendorSpotfire Affected up to 4.2.0; 5.0.x and later; 6.0.x and later Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8590
- 2026-10-03 Alias added: GHSA-q55h-7282-gq6q
References
More Spotfire vulnerabilities
- TI-2024-03117 Spotfire Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
- TI-2025-02719 Spotfire Code Execution Vulnerability CVSS 4.0CRITICAL 9.4
- TI-2024-03118 Spotfire: NTLM token leakage CVSS 3.1MEDIUM 6.8
Sources
- CVE-2026-8590 · CVE Program
- CVE-2026-8590 · NVD
- FIRST EPSS
- GHSA-q55h-7282-gq6q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences