CVE-2026-35178: Salesforce Workbench RCE Vulnerability

CVE-2026-35178 Overview

CVE-2026-35178 is a critical remote code execution (RCE) vulnerability in Workbench, a popular suite of tools used by administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. The vulnerability exists in the timezone conversion flow, which processes attacker-controlled cookie values in an unsafe manner, leading to code injection (CWE-94). This vulnerability affects all versions prior to 65.0.0.

Critical Impact
Attackers can achieve remote code execution by crafting malicious cookie values that are processed unsafely during timezone conversion, potentially compromising the integrity and confidentiality of Salesforce organization data and connected systems.

Affected Products

Workbench versions prior to 65.0.0
Salesforce Workbench installations using the vulnerable timezone conversion flow
Self-hosted Workbench deployments with exposed web interfaces

Discovery Timeline

2026-04-06 - CVE-2026-35178 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35178

Vulnerability Analysis

This vulnerability stems from improper handling of user-controlled input in the timezone conversion functionality of Workbench. The application processes cookie values without adequate sanitization or validation, allowing an attacker to inject malicious code that gets executed on the server. Since Workbench serves as an administrative interface for Salesforce organizations, successful exploitation could grant attackers access to sensitive organizational data, API credentials, and the ability to perform administrative actions within connected Salesforce instances.

The attack requires user interaction, as the victim must have an active Workbench session for the malicious cookies to be processed. However, the network-accessible nature of the vulnerability and the lack of authentication requirements for the initial attack vector make it a significant threat to organizations using Workbench.

Root Cause

The root cause is a code injection vulnerability (CWE-94) where the timezone conversion flow directly processes attacker-controlled cookie values without proper input validation or sanitization. The application fails to implement secure coding practices when handling external input, allowing arbitrary code to be interpreted and executed within the application context.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker crafts malicious cookie values that, when processed by the timezone conversion functionality during a legitimate user session, result in code execution. The attacker does not require any prior privileges on the system. Successful exploitation impacts both the vulnerable system and potentially connected downstream Salesforce systems, leading to high confidentiality and integrity impact.

The vulnerability mechanism involves the unsafe processing of cookie data during timezone conversion operations. When a user with an active session accesses functionality that triggers the timezone conversion flow, the malicious payload embedded in the cookie is evaluated and executed. For detailed technical information, refer to the GitHub Security Advisory GHSA-jw63-m86r-2jxc.

Detection Methods for CVE-2026-35178

Indicators of Compromise

Unusual or malformed cookie values containing code-like structures or escape sequences in Workbench-related requests
Unexpected server-side execution or process spawning from Workbench application contexts
Anomalous outbound network connections originating from Workbench server processes
Log entries showing timezone conversion errors with unusual payloads

Detection Strategies

Implement web application firewall (WAF) rules to inspect and block requests with suspicious cookie patterns targeting Workbench endpoints
Monitor application logs for timezone conversion flow anomalies and error patterns that may indicate exploitation attempts
Deploy endpoint detection and response (EDR) solutions to identify unexpected code execution from web application processes
Perform regular security audits of Workbench configurations and access logs

Monitoring Recommendations

Enable detailed logging for all Workbench application requests, particularly those involving session and cookie handling
Configure alerting for unusual process creation or network activity from systems hosting Workbench
Monitor for bulk or automated requests to timezone-related functionality that may indicate scanning or exploitation attempts

How to Mitigate CVE-2026-35178

Immediate Actions Required

Upgrade Workbench to version 65.0.0 or later immediately
Restrict network access to Workbench instances to trusted IP ranges and authenticated users only
Review access logs for any signs of exploitation attempts prior to patching
Implement additional authentication controls for administrative interfaces

Patch Information

The vulnerability has been fixed in Workbench version 65.0.0. The patch addresses the unsafe processing of cookie values in the timezone conversion flow by implementing proper input validation and sanitization. Organizations should review the GitHub Pull Request #869 for technical details on the fix and the GitHub Security Advisory GHSA-jw63-m86r-2jxc for complete remediation guidance.

Workarounds

If immediate patching is not possible, consider temporarily disabling public access to Workbench instances
Implement strict Content Security Policy (CSP) headers to limit code execution contexts
Deploy a reverse proxy with request filtering to sanitize cookie values before they reach the Workbench application
Use network segmentation to isolate Workbench deployments from critical infrastructure

bash

# Example: Restrict Workbench access via nginx reverse proxy
# Add to nginx server block configuration
location /workbench/ {
    # Limit access to trusted IP ranges
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Add security headers
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    
    proxy_pass http://workbench-backend;
}