Introduction
CVE-2025-52448 is a critical flaw in how Salesforce Tableau Server handles user-controlled keys in its validate-initial-sql API modules. It could let attackers bypass authorization controls and reach sensitive backend data. Unauthorized access to a production database can have immediate consequences for data integrity and confidentiality.
About the involved parties:
Tableau, now owned by Salesforce, is an analytics and business intelligence platform. Its customers include enterprises, governments, and research institutions around the world. Tableau Server is the self-hosted version, widely deployed for on-premises analytics and data visualization. Salesforce, a large cloud and SaaS provider, supports millions of users and thousands of organizations worldwide, so a vulnerability in its platforms can have a wide impact across industries.
Technical information
CVE-2025-52448 is an authorization bypass vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The flaw is in Tableau Server's validate-initial-sql API modules, on both Windows and Linux. Attackers can manipulate the user-controlled parameters or keys passed to the validate-initial-sql endpoint. If the API does not properly validate these keys, an attacker may bypass authorization checks and gain direct access to the production database cluster.
The root cause is insufficient validation of user-supplied keys or parameters in the API logic. Because of it, unauthorized users can reach sensitive data or backend functions meant only for authenticated or privileged users. No public code snippets or exploit samples are available for this vulnerability.
Affected systems and versions
- Tableau Server on Windows and Linux
- Affected versions:
- Before 2025.1.3
- Before 2024.2.12
- Before 2023.3.19
- Vulnerable component: validate-initial-sql API modules
Vendor security history
Salesforce has fixed several earlier security issues in Tableau Server. One of them, CVE-2025-26494, was a server-side request forgery (SSRF) vulnerability that allowed authentication bypass. Other recent CVEs involved configuration and access-control weaknesses in Salesforce and Tableau products. Salesforce typically issues prompt advisories and patches for critical vulnerabilities, though some issues have needed multiple updates before they were fully resolved.
