alteryx.com
By Alteryx Vulnerability disclosure program on security.txt alteryx.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 5
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- https://www.alteryx.com/trust
Rewards
What the company's own policy page says it pays.
When we last read the linked page (12 Nov 2026), it did not look like a security policy. The program may have moved or closed; check the company's site before you test.
This program does not pay cash rewards.
Scope
1 asset you may test.
Domains 1
- alteryx.com
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-63291 | When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller. The Alteryx server did not check whether the authenticated user had permission to access the specified MongoDB object ID. By specifying particlar MongoDB object IDs, callers could obtain records for other users without proper authorization. | Medium 5.4 | 14 Nov 2025 |
| CVE-2025-28244 | Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover | High 8.8 | 10 Jul 2025 |
| CVE-2025-28245 | Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body. | Medium 6.1 | 10 Jul 2025 |
| CVE-2025-28243 | An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component. | High 8.0 | 10 Jul 2025 |
| CVE-2023-26961 | Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request. | Medium 4.8 | 8 Aug 2023 |