Video |

Tableau | Tool strategy | Industry trends

LOG4J2 fix for All Tableau products - (Updated 15th December) see description for more

If you're on an older Tableau build, the Log4j2 vulnerability means you need to update or uninstall it right now.

Tim Ngwena •16 December 2021 •1 min read •7 min watch •2.1K

Part ofBehind The Scenes

Watch on YouTube

Every Tableau product is affected by the Log4j2 remote code execution vulnerability, including Desktop, Public, Reader, Online, Server and Prep Builder across Windows, Mac and Linux.
You must be on the build released on 15th December 2021 to be patched, not just on 2020.4 generally; versions 2020.3 and older are past end of maintenance and will not be patched.
Tableau Prep treats every release as a patch, so your only fix is to upgrade to the latest version (2021.4.1), not stay on an older build.
Tableau's knowledge base offers manual mitigation steps, but they need admin rights and are hard to maintain, so updating is by far the easiest route.
Uninstall old versions entirely; leaving them on your laptop keeps you exposed, as a targeted workbook could compromise your machine and reach your server and data.

0:00Hey, Sim here. This is probably one of the

0:02most important videos I've made all year.

0:04If you're

0:04using a version of Tableau that is older

0:07than 2020.4 and it's not the most recent

0:10build of 2020.4,

0:12then you need to uninstall it or update it

0:15immediately. So I'm literally rendering

0:18this

0:18video on the Log4j2 vulnerability. I just

0:22literally recorded it thinking that there's

0:25a fix

0:26to the original vulnerability. Now there

0:29actually is and everything you're going to

0:31see in this

0:32video is something I would still recommend

0:34you do because it does reduce your risk

0:36from this particular vulnerability. But

0:39there is yet another issue with this Log4j2

0:42particular patch. Big thanks to Mark Reed,

0:46Tableau's endmaster, for alerting me to

0:49this

0:49right before I published this video. So

0:51what I'm going to do is I'm going to put

0:53this in the

0:54description. I don't have time to re-record

0:56the video so I'm going to put the notes to

0:58that

0:59particular new issue in the description of

1:01this video. And so everything I'm saying in

1:04this video

1:05just watch it but bear in mind that there

1:07might yet be another set of updates after

1:09what I've

1:10recommended doing in this video in order to

1:12be fully up to date and not be vulnerable

1:15to the Log4j2

1:16vulnerabilities that are being discovered

1:19as we speak. So yeah that's just a small

1:22sort of

1:23preamble for this video. Enjoy the rest of

1:25it. In essence the Log4j2 vulnerability

1:28that has sort of

1:28been moving through the technology sphere

1:30at the moment has a vulnerability that

1:32essentially allows

1:33for remote code execution in products that

1:36use this particular technology in Apache.

1:39Now Apache is a piece of open source, I

1:41think it's open source software, I'm going

1:43to call it

1:43software it's probably not the right term,

1:45but essentially it's a particular

1:47technology that's

1:48incorporated in lots of software to allow

1:50it to sort of communicate with the web and

1:52other web-based

1:53technologies. Now in essence because all of

1:56Tableau products use this capability, all

1:59Tableau

1:59products are affected and you might think

2:01this only involves server or Tableau Online

2:03. This

2:04actually involves every single Tableau

2:06product. Tableau Desktop, Tableau Public,

2:09Tableau Reader,

2:11Tableau Online, Tableau Server, Tableau

2:13Prep Builder for Mac, Windows and all of

2:16those Tableau Online

2:17Tableau Desktop, you know everything

2:19everything's affected. You know whether it

2:21's Linux, Windows or

2:22Mac it's affected. This vulnerability is

2:25sort of one of those vulnerabilities that

2:27comes through

2:27in the technology sphere and just you know

2:29shakes everything up. Now it's super

2:31important you update

2:33and the reason the version really matters

2:34here is because if you're using an older

2:36version of 2020.4

2:38then you've kind of been forced into an

2:40unhappy wedge here because any older

2:43version of Tableau

2:45doesn't actually have maintenance anymore.

2:47So this is one of those weird cases where

2:49maintenance ended for 2020.3 and older and

2:53a while back essentially Tableau said they

2:56weren't going to

2:56patch these. If I go to the Tableau website

2:59here, let me go to the desktop builds

3:01because these are

3:02a bit easier to see and I go to 2020.3 and

3:05I go to the most recent release, 15th of

3:08September,

3:09you'll see here that when I go to this page

3:11there's an early end of maintenance notice

3:13here

3:13that essentially says that Tableau is not

3:15going to be updating this going forward.

3:17Why this really

3:18matters is when a vulnerability comes up

3:19because what they're not going to do is

3:21update this version

3:23to meet that vulnerability. So if you go

3:25back to the downloads and you look at 2020.

3:284 you'll see

3:29they actually have patched that specific

3:31version. So if I go back go to 2020.4 and

3:34look at the update

3:35from the 15th of December then you'll see

3:37that the patch that was applied here is for

3:39this particular

3:40vulnerability. Now the thing to bear in

3:43mind here is that you can't just be on 2020

3:46.4 you have to be

3:48on the version released on the 15th of

3:50December with all versions whether it's

3:52Tableau prep if

3:53I go to the latest version here for example

3:56and I look at this you'll see that this was

3:58specifically

3:58fixed in the 15th of December and with

4:01Tableau prep there's another kicker because

4:03if you go back

4:05and they don't actually often update older

4:08versions so for Tableau prep you can't stay

4:11on an older

4:12version and assume to get the latest

4:14features right so if you're on Tableau prep

4:17your only

4:18option really is to update to 21.4.2 that

4:21you can't use an older version it's just it

4:24's just

4:24not an option because those versions have

4:27not been patched to meet this vulnerability

4:30. So the other

4:30complication here is that each software has

4:33a slightly different requirement with

4:35desktop

4:36if I go to let's say 21.3 and I look at the

4:38patches you see they have actually patched

4:41this

4:41to meet the latest releases so because of

4:44the way Tableau prep works essentially

4:46every release is a

4:47patch so therefore you can't sort of expect

4:50them to patch older versions to meet today

4:53's requirements

4:53for this particular vulnerability sort of a

4:55weird thing to have to explain to people.

4:57Tableau version

4:58numbers and patches and updates and

5:00upgrades are just sometimes a complex thing

5:02to explain maybe

5:03that's a video in itself but nonetheless

5:05that's something to be aware of. If you're

5:07using Tableau

5:08prep your only option to fix this

5:10vulnerability is to install the latest

5:12version that's not just

5:14the one that was patched today or 15th of

5:16December depending on when you watch this

5:18specifically 2021.4.1 is the only version

5:23that has this particular patch for this

5:26vulnerability.

5:28Now if I go back, Tableau have this really

5:31nice support guide which you can sort of go

5:33through

5:34essentially the main option here is to

5:35update if you don't want to update let's

5:37say you want to do

5:38something else that's also fine what I'd

5:40encourage you to do is to just look at this

5:43knowledge base

5:44article I'll put a link to it in the

5:45description so you can check it out

5:47yourself there are

5:47different instructions if you don't want to

5:50update your software what I will say about

5:52these is that

5:52I think they're a little hard to maintain

5:55there's a lot of steps 11 steps for Linux,

5:578 steps for Windows, 9 I mean these are not

6:00the kind of steps that most people in

6:02corporate

6:03environments can do without having some

6:05sort of admin access you know on Mac OS

6:08doing suited

6:08commands on a work laptop is going to

6:11require you to have admin rights on your

6:13computer.

6:14On Windows editing things like your

6:16registry and going in and changing

6:18directories specifically

6:20where things are installed and changing the

6:22values of all these things is also going to

6:25require admin

6:25rights I'm pretty certain it's going to

6:28require admin rights so definitely try and

6:31check to see

6:32okay is your organization already doing

6:34this if you're using Tableau on your

6:35personal machine

6:36Tableau public Tableau desktop then you

6:38need to just go ahead and do these things

6:40anyway

6:40by far the easiest thing to do is just to

6:43update Tableau this way you know you've got

6:45the latest

6:46version of Tableau if something else comes

6:47out with this vulnerability you know that

6:49you're up

6:50to date and you can essentially just keep

6:52updating but for everything else you need

6:54to uninstall

6:55older versions and make sure you uninstall

6:57them because you're still exposed if you've

6:59got them

6:59sitting on your laptop you've still got

7:01them sitting there and someone could send

7:03you a

7:03workbook that's targeted for one of these

7:05older versions you could sort of innocently

7:07open it

7:07and make a mistake and now your laptop

7:09becomes compromised and someone can take

7:12control of your

7:12laptop using this vulnerability then from

7:14your laptop get access to your server and

7:16all your data

7:17it's a nightmare you don't want to live in

7:20so update Tableau it's really important and

7:23yeah

7:23I'll catch you in the next video.

Rollup

Every Tableau product is exposed to the Log4j2 remote code execution vulnerability, and the only reliable fix is updating to the specific patched build released on 15th December 2021, not just any recent version.

This covers Tableau Desktop, Public, Reader, Online, Server and Prep Builder across Windows, Mac and Linux, all of which use the affected Apache Log4j2 component. Tim recorded this as the situation was unfolding, so he flags that further patches may follow after this video.

The Breakdown

Every Tableau product is affected 1:23

Log4j2 is embedded across Apache-based technology used throughout the Tableau product line, so the vulnerability isn't limited to Server or Online — Desktop, Public, Reader, Prep Builder and every OS build are all exposed.
Being on 2020.4 isn't enough 2:22

You need the exact build released on 15th December 2021, not just 'the 2020.4 line' in general — check the specific release date on the download page before assuming you're covered.
Older versions past end of maintenance won't be patched 2:41

2020.3 and earlier already had maintenance withdrawn, so Tableau isn't issuing a fix for them regardless of the vulnerability's severity — staying on those builds means staying exposed indefinitely.
Tableau Prep has its own versioning quirk 3:41

Because every Prep release functions as a patch rather than a separate maintained branch, you can't wait for an older Prep version to be updated — 2021.4.1 is the only version with the fix, so upgrading is the only option.
Manual mitigation exists but is hard to sustain 5:24

Tableau's knowledge base lists manual workaround steps (registry edits on Windows, terminal commands on Mac), but they require admin rights and are easy to get wrong or fall behind on — treat this as a stopgap, not a real alternative to updating.
Uninstall, don't just ignore, old installs 6:40

Leaving an outdated version sitting on your machine keeps you exposed even if you never open it yourself — a specifically crafted workbook opened in that old version could compromise your laptop and, from there, your server and data.

Worth Knowing

This vulnerability was still evolving as the video was made — Tim notes a further Log4j2 issue emerged after this patch and points to the video description for updates.
Manual mitigation steps require admin rights (sudo on Mac, registry/directory changes on Windows), which most people in corporate environments won't have.
Version numbers and patch behaviour differ by product, so don't assume the same update logic applies to Desktop, Server and Prep uniformly.

Use It When

Reach for this the moment you're auditing what Tableau builds are running across your organisation or on your own laptop after a security advisory — check exact patch dates, not just major version numbers, and uninstall anything unpatched rather than leaving it dormant.

How this Rollup was made provenance & method

A Rollup is drafted by AI from the video's transcript, then reviewed and edited by Tim. Everything used to produce this one is listed below — the model, the exact prompt, and the source video — so the process is transparent and reproducible.

Transcription: On-device — NVIDIA Parakeet v3 for recent videos, OpenAI Whisper large-v3 for earlier ones. The transcript never leaves the machine or gets published.
Drafting: Claude Sonnet 5 in the cloud, from that transcript.
Prompt: The exact Rollup prompt (v2) — the full system prompt, unedited.
Source video: Watch on YouTube
Drafted: 5 July 2026 at 09:38
Reviewed & edited: 5 July 2026 at 09:41 · by Tim Ngwena

Model + prompt + video is everything you'd need to recreate a Rollup like this yourself. The one thing we don't share is the transcript.

Rights. The video and its transcript are the property of TN Media Ltd. Unauthorised use or download is prohibited. © TN Media Ltd.