CVE-2025-26495: Tableau Server

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.

Affected products

• Tableau Tableau Server: from 2020.4, before 2020.4.19 (fixed in 2020.4.19); from 2021.1, before 2021.1.16 (fixed in 2021.1.16); from 2021.2, before 2021.2.14 (fixed in 2021.2.14); from 2021.3, before 2021.3.13 (fixed in 2021.3.13); from 2021.4, before 2021.4.8 (fixed in 2021.4.8); from 2022.1, before 2022.1.3 (fixed in 2022.1.3)

Published 2025-02-11. Last modified 2026-06-17.