Salesforce Tableau Server Authorization Bypass Vulnerability in validate-initial-sql API Modules

A vulnerability allowing authorization bypass through user-controlled keys has been identified in Salesforce Tableau Server. This issue is present on both Windows and Linux platforms, specifically within the validate-initial-sql API modules. The vulnerability allows for interface manipulation, granting unauthorized access to the production database cluster. Affected Tableau Server versions include those prior to 2025.1.3, 2024.2.12, and 2023.3.19.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the production database cluster, allowing for potential data manipulation or extraction.

Remediation

Users are advised to update Tableau Server to the latest supported maintenance release for their branch. The latest version can be downloaded from the Tableau Server Maintenance Release page. Additionally, customers with a Trino (formerly Presto) driver installed should update their driver to the latest version.