CVE-2025-26495

Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SalesforceCNA
---
---
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
VendorProductVersion
tableautableau_server
2020.4 ≤
𝑥
< 2020.4.19
tableautableau_server
2021.1 ≤
𝑥
< 2021.1.16
tableautableau_server
2021.2 ≤
𝑥
< 2021.2.14
tableautableau_server
2021.3 ≤
𝑥
< 2021.3.13
tableautableau_server
2021.4 ≤
𝑥
< 2021.4.8
tableautableau_server
2022.1 ≤
𝑥
< 2022.1.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://help.salesforce.com/s/articleView?id=000390611&type=1