CVE-2026-35178 is a critical remote code execution flaw in Workbench, an open source tool for Salesforce administrators. NVD scores it 9.8. The timezone conversion flow handles cookie values unsafely. Upgrade to Workbench 65.0.0 or later. Rotate Salesforce tokens if your instance was ever public.
What's affected
forceworkbench Workbench before 65.0.0. The fixed release is 65.0.0.
This is the open source project that you host yourself. If you use someone else's hosted instance, ask that operator about their version.
How to check if you're exposed
Check the version of the Workbench copy you host, from the project files or the release tag you deployed. If you run it behind a web server, find out whether it is reachable from the internet and who has access.
What to do now
- Upgrade your hosted Workbench to 65.0.0 or later.
- If you cannot update yet, take the instance offline or limit it to a VPN.
- Check the server for unexpected files and processes if the instance was public.
- Rotate the Salesforce credentials and tokens that users have connected through that instance, since it holds access to your orgs.
Why it matters
The weakness is CWE-94, improper control of code generation. The record says the timezone conversion flow processes attacker controlled cookie values in an unsafe way. The advisory text is brief, so the exact mechanism is in the pull request linked under Sources.
Cookies are fully under the sender's control. Any code path that feeds a cookie into an interpreter or a function that builds code gives that sender a way to run their own code. A tool that holds credentials for Salesforce orgs is a valuable target.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Workbench is popular because it gives administrators direct access to the Salesforce APIs. That also makes a self hosted copy a store of powerful access. Keep it off the internet, limit who can sign in, and use the shortest token lifetimes your org allows. After the upgrade, review which users connected through it, and revoke any sessions you do not recognize.
Quick check
I use Workbench only from my own laptop. Am I at risk?
The risk depends on whether the web interface is reachable by others. Update anyway.
Sources
Last reviewed: 19 October 2026.
