Salesforce Agentforce Vulnerability "SalesBleed" Exposed CRM Data via Zero-Click AI Exploit
Researchers at Zenity Labs uncovered a now-patched vulnerability in Salesforce’s Agentforce, dubbed SalesBleed, which could have enabled attackers to steal sensitive CRM data without authentication, tenant access, or user interaction. The flaw, disclosed in August, was remediated by Salesforce after investigation.
The attack exploited indirect prompt injection via Salesforce’s public-facing Web-to-Lead forms, which allow external users to submit sales leads. Attackers embedded malicious instructions in seemingly legitimate lead submissions, which remained stored in the organization’s Leads table. When an employee later queried Agentforce such as reviewing recent leads the AI agent processed the poisoned record, triggering the exploit.
The injected instructions could direct Agentforce’s General CRM subagent to access and exfiltrate additional CRM data, including Account records, leveraging its existing query permissions. Since the subagent already had access to both lead and account data, no privilege escalation was required. Stolen data such as company names or deal sizes was encoded into a subdomain of an attacker-controlled URL, bypassing Salesforce’s Trusted URLs redaction mechanism.
Zenity researchers identified edge cases in Salesforce’s URL-redaction logic, where malformed strings evaded detection while still being rendered as fetchable URLs in HTML image tags. When the Agentforce client attempted to load the external image, a DNS lookup exposed the encoded data to the attacker’s server. The attack was zero-click, requiring no interaction from the victim beyond routine AI queries.
Salesforce addressed the issue by replacing its regex-based URL parsing with a more standards-compliant approach, closing the bypass conditions. The incident highlights risks in AI workflows combining attacker-controlled input, sensitive data access, and output exfiltration channels particularly in unauthenticated systems like Web-to-Lead, where malicious submissions can persist undetected.
Source: https://cybersecuritynews.com/salesforce-salesbleed-vulnerability/
Salesforce cybersecurity rating report: https://www.rankiteo.com/company/salesforce
"id": "SAL1790332225",
"linkid": "salesforce",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Salesforce customers using '
'Agentforce and Web-to-Lead '
'forms',
'industry': 'Technology/CRM',
'location': 'Global',
'name': 'Salesforce',
'size': 'Enterprise',
'type': 'Software/Cloud Service Provider'}],
'attack_vector': 'Indirect Prompt Injection',
'data_breach': {'data_exfiltration': 'Yes (via encoded subdomains in '
'attacker-controlled URLs)',
'sensitivity_of_data': 'High (business-sensitive data, e.g., '
'company names, deal sizes)',
'type_of_data_compromised': ['CRM data',
'Account records',
'Lead submissions']},
'date_detected': '2024-08',
'date_publicly_disclosed': '2024-08',
'date_resolved': '2024-08',
'description': 'Researchers at Zenity Labs uncovered a now-patched '
'vulnerability in Salesforce’s Agentforce, dubbed '
'*SalesBleed*, which could have enabled attackers to steal '
'sensitive CRM data without authentication, tenant access, or '
'user interaction. The flaw was exploited via indirect prompt '
'injection through Salesforce’s public-facing Web-to-Lead '
'forms, allowing malicious instructions to persist in the '
'Leads table. When processed by Agentforce’s AI agent, these '
'instructions could exfiltrate additional CRM data, including '
'Account records, via encoded subdomains in '
'attacker-controlled URLs, bypassing Salesforce’s Trusted URLs '
'redaction mechanism.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'unauthorized data exposure',
'data_compromised': 'Sensitive CRM data (e.g., Account records, '
'company names, deal sizes)',
'operational_impact': 'Potential unauthorized access to CRM data '
'without user interaction',
'systems_affected': 'Salesforce Agentforce, Web-to-Lead forms, '
'General CRM subagent'},
'initial_access_broker': {'entry_point': 'Web-to-Lead forms',
'high_value_targets': 'CRM data (Account records)'},
'investigation_status': 'Resolved',
'lessons_learned': 'Risks in AI workflows combining attacker-controlled '
'input, sensitive data access, and output exfiltration '
'channels, particularly in unauthenticated systems like '
'Web-to-Lead forms where malicious submissions can persist '
'undetected.',
'post_incident_analysis': {'corrective_actions': 'Replaced regex-based URL '
'parsing with '
'standards-compliant '
'approach to close bypass '
'conditions',
'root_causes': 'Indirect prompt injection via '
'Web-to-Lead forms, flawed URL '
'redaction logic, and AI agent '
'processing of attacker-controlled '
'input'},
'recommendations': 'Implement stricter input validation for public-facing '
'forms, enhance URL redaction mechanisms, and monitor AI '
'agent interactions for anomalous behavior.',
'references': [{'source': 'Zenity Labs'}],
'response': {'containment_measures': 'Salesforce patched the vulnerability by '
'replacing regex-based URL parsing with '
'a standards-compliant approach',
'remediation_measures': 'Fixed URL redaction logic to prevent '
'bypass of Trusted URLs mechanism',
'third_party_assistance': 'Zenity Labs (researchers)'},
'title': 'SalesBleed: Salesforce Agentforce Vulnerability Exposed CRM Data '
'via Zero-Click AI Exploit',
'type': 'Data Exfiltration',
'vulnerability_exploited': 'SalesBleed (Zero-Click AI Exploit via Web-to-Lead '
'Forms)'}