CVE-2026-8590

Spotfire OAuth2 PKCE Bypass for public clients

State: Published
Severity: 8.7 High
Published: Jul 14, 2026
Updated: Jul 14, 2026
Reserved: May 14, 2026

Description

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules).

This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	Spotfire

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Spotfire EnterpriseSpotfire	14.0.12 and earlierAffected 14.4.2 and earlierAffected 14.5.0 and earlierAffected 14.6.1 and earlierAffected 14.6.2 and earlierAffected 14.7.0 and earlierAffected 14.8.0 and earlierAffected
Spotfire Enterprise with External ConsumersSpotfire	14.0.12 and earlierAffected 14.5.0 and earlierAffected 14.6.0 and earlierAffected 14.6.1 and earlierAffected 14.6.2 and earlierAffected 14.7.0 and earlierAffected 14.8.0 and earlierAffected
Spotfire on KubernetesSpotfire	4.2.0 and earlierAffected 5.0.xAffected 6.0.xAffected

References

https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-july-14-2026-spotfire-cve-2026-8590-r3641/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.