EUVD-2026-43678
GHSA-q55h-7282-gq6q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N) but gated by required user interaction (UI:R); high confidentiality/integrity and low availability impact per the vendor 4.0 vector, scope unchanged.
Primary rating from Vendor (Spotfire).
CVSS VectorVendor: Spotfire
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Consumers (Spotfire Server modules), Spotfire Spotfire on Kubernetes (Spotfire Server modules).
This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire Enterprise with External Consumers: through 14.0.12, through 14.5.0, through 14.6.0, through 14.6.1, through 14.6.2, through 14.7.0, through 14.8.0; Spotfire on Kubernetes: through 4.2.0, 5.0.X, 6.0.X.
Articles & Coverage 1
AnalysisAI
Information disclosure with integrity impact in the Spotfire Server modules of Spotfire Enterprise, Spotfire Enterprise with External Consumers, and Spotfire on Kubernetes allows a remote, unauthenticated attacker to obtain sensitive data and alter server-side state once a victim is lured into a passive interaction (UI:P), such as opening a crafted link or analysis. The CVSS 4.0 base score is 8.7 (High) with high confidentiality and integrity impact and low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.
Technical ContextAI
The affected component is the Spotfire Server modules underpinning Cloud Software Group's (formerly TIBCO) Spotfire analytics platform across its self-managed Enterprise, External Consumers, and Kubernetes-hosted deployments (CPEs cpe:2.3:a:spotfire:spotfire_enterprise, spotfire_enterprise_with_external_consumers, and spotfire_on_kubernetes). No CWE was assigned by the source, so the root-cause class is not formally classified; however, the 'Information Disclosure' tag combined with the CVSS 4.0 vector (UI:P, VC:H, VI:H) is consistent with a web-facing flaw in the server's HTTP interface - such as a cross-site scripting, response-splitting, or crafted-content issue - where attacker-controlled input processed during a user-triggered action leaks data and permits state modification. The presence of a Kubernetes variant indicates the same server code is shipped both as traditional on-prem installs and as containerized workloads.
RemediationAI
Patch available per vendor advisory: consult the Spotfire Security Advisory of July 14, 2026 (https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-july-14-2026-spotfire-cve-2026-8590-r3641/) and upgrade each product past its listed affected ceiling - Spotfire Enterprise and External Consumers builds beyond the 14.8.0 branch, and Spotfire on Kubernetes beyond the 4.2.0/5.0.X/6.0.X lines; exact fixed-version numbers are not provided in this dataset and must be confirmed from that advisory. Because exploitation requires luring a user via the network-facing Spotfire Server, interim compensating controls include restricting Spotfire Server web access to trusted networks or VPN, placing the server behind a reverse proxy/WAF that filters crafted requests and adds content-security and anti-clickjacking headers, and advising users not to open untrusted Spotfire links - with the trade-off that these reduce but do not eliminate the risk and may impede legitimate External Consumers access. For Kubernetes deployments, apply the updated container image and tighten ingress exposure.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today