What are the critical vulnerabilities in Salesforce Tableau Server, and how can they be exploited by attackers?

Key takeaways

• Eight critical flaws could allow code execution or database access.
• CVE-2025-52449 is described as the most severe.
• Upgrade to the fixed Tableau Server release.

Table of Contents

• What Are the Latest Salesforce Tableau Vulnerabilities About?
• Why Are These Tableau Vulnerabilities Considered Critical?
• Breakdown of the Key CVEs and Their Impact
• What Makes CVE-2025-52449 the Most Severe?
• How Do the Authorization Bypass Vulnerabilities Work?
• Understanding the Path Traversal Attack (CVE-2025-52452)
• What Are Server-Side Request Forgery (SSRF) Vulnerabilities?
• Who Is Affected?
• How Can Organizations Mitigate These Vulnerabilities?
• Salesforce's Official Recommendation
• Conclusion

What Are the Latest Salesforce Tableau Vulnerabilities About?

Salesforce's Tableau Server, widely used for business data visualization, is currently under security scrutiny due to the discovery of eight critical vulnerabilities. These flaws could allow Remote Code Execution (RCE), unauthorized access to production databases, and Server-Side Request Forgery (SSRF). Affected versions include those prior to 2026.1.3, 2024.2.12, and 2023.3.19.

The vulnerabilities were publicly disclosed in a security advisory published on June 26, 2025, prompting immediate patching instructions for all enterprise users.

Why Are These Tableau Vulnerabilities Considered Critical?

These vulnerabilities collectively expose an extensive attack surface across Tableau Server components, including:

• Extensible Protocol Service modules

• Tabdoc API command modules

• Flow Data Source and Amazon S3 connectors

• EPS Server components

The most severe flaw, CVE-2025-52449, is rated 8.5 on the CVSS 3.1 scale and allows RCE via unrestricted file uploads using deceptive filenames.

Breakdown of the Key CVEs and Their Impact

What Makes CVE-2025-52449 the Most Severe?

The Extensible Protocol Service module flaw allows attackers to upload arbitrary files disguised with safe-looking extensions. These files can then bypass security filters and get executed on the server, leading to full system takeover.

Such vulnerabilities are particularly dangerous in enterprise deployments where Tableau Server is integrated with internal services and sensitive data platforms.

How Do the Authorization Bypass Vulnerabilities Work?

Three flaws (CVE-2025-52446, 52447, and 52448) stem from improper handling of user-controlled keys in:

• tab-doc API modules

• set-initial-sql tabdoc commands

• validate-initial-sql APIs

These weaknesses allow attackers to modify queries or interface behaviors, granting them unauthorized access to sensitive production databases.

Understanding the Path Traversal Attack (CVE-2025-52452)

A classic security issue, this path traversal vulnerability exists in the duplicate-data-source function of the tabdoc API. It lacks proper checks on pathnames, allowing attackers to traverse directories and expose sensitive files across the server's file system.

What Are Server-Side Request Forgery (SSRF) Vulnerabilities?

The three SSRF vulnerabilities in Tableau can let attackers spoof internal server requests, reaching private endpoints or cloud infrastructure:

• CVE-2025-52453: Flow Data Source

• CVE-2025-52454: Amazon S3 Connector

• CVE-2025-52455: EPS Server

These flaws allow attackers to gain access to internal APIs, metadata, or even cloud secrets, which can then be used for lateral movement or data exfiltration.

Who Is Affected?

All enterprise organizations running Tableau Server on versions older than:

• 2026.1.3

• 2024.2.12

• 2023.3.19

This includes installations using integrated tools like Trino (formerly Presto) or custom authentication modules.

How Can Organizations Mitigate These Vulnerabilities?

Immediate Actions:

• Patch Now: Upgrade to the latest version within your current major release.

• Update Trino Drivers: Ensure that all JDBC/ODBC drivers are updated to their latest versions.

• Check Server Logs: Audit for suspicious activity post-disclosure (June 26, 2025).

• Restrict Upload Paths: Disable or sandbox untrusted file uploads if patching is delayed.

Long-Term Measures:

• Consider shifting to cloud-hosted Tableau services, which receive automatic updates.

• Implement Web Application Firewalls (WAFs) to detect SSRF and RCE patterns.

• Enforce zero-trust network policies around your Tableau Server environment.

Salesforce's Official Recommendation

Salesforce urges customers to:

“Update to the latest supported Maintenance Release as per your deployment branch. Unsupported versions should be upgraded immediately to a supported branch to ensure patch compliance and security.”

Conclusion: Act Now to Avoid Data Breaches

With multiple CVEs affecting core Tableau functionalities, these flaws represent a serious threat to enterprise data security. Organizations using Tableau Server should prioritize patching, conduct internal risk assessments, and ensure zero-day protections are in place. RCE and SSRF vulnerabilities are actively exploited in the wild, delay in patching could lead to real-world breaches.

Related reading

• What is the new PerfektBlue Bluetooth vulnerability affecting vehicles globally in 2026?
• What are CVE-2025-27210 and CVE-2025-27209 vulnerabilities in Node.js, and how can Windows applications protect against these high-severity flaws?
• What are the Apache Tomcat and Camel vulnerabilities CVE-2025-24813, CVE-2025-27636, and CVE-2025-29891 and how are they being exploited in the wild?

Reference

For the authoritative details, see National Vulnerability Database.