Vulnerability · Published Jul 14, 2026 · Assigned by Spotfire
CVE-2026-8590Spotfire OAuth2 PKCE Bypass for public clients
High 8.7
In plain English
A high-severity security flaw in Spotfire Enterprise from Spotfire. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules). This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spotfire | Spotfire Enterprise | 0 – through 14.0.120 – through 14.4.20 – through 14.5.00 – through 14.6.10 – through 14.6.20 – through 14.7.00 – through 14.8.0 |
| Spotfire | Spotfire Enterprise with External Consumers | 0 – through 14.0.120 – through 14.5.00 – through 14.6.00 – through 14.6.10 – through 14.6.20 – through 14.7.00 – through 14.8.0 |
| Spotfire | Spotfire on Kubernetes | 0 – through 4.2.05.0.x6.0.x |