SalesBleed Zero-Click Data Exfiltration Path Exposed & Patched
Salesforce Agentforce was affected by three vulnerabilities disclosed on September 24, 2026, that allowed poisoned Web-to-Lead submissions to trigger zero-click CRM data exfiltration and phishing actions. The attack chains have been patched, but the disclosure exposes a concrete security risk for organizations connecting Agentforce to externally submitted data. (labs.zenity.io)
SalesBleed Used Web-to-Lead as the Entry Point
The vulnerabilities, named SalesBleed by Zenity Labs in its technical disclosure, began with an attacker submitting a seemingly normal lead through a public Web-to-Lead form. A hidden indirect prompt injection in one of the lead fields remained stored in Salesforce until an employee later asked Agentforce to review recent leads.
Agentforce then processed the malicious lead as part of the employee’s legitimate request. The injected instructions directed the agent to query CRM records, including account data, and place selected values into an attacker-controlled URL. The same General CRM subagent had access to both lead and account records, so the attack did not require a privilege escalation. (labs.zenity.io)
Trusted URL Controls Were Bypassed
The data left the org through a weakness in the way Agentforce’s Trusted URLs protection identified and redacted untrusted destinations. Zenity found that unusual top-level domains and specific URL termination characters could cause the redaction layer and the rendering client to interpret the same string differently.
That gap allowed the agent to produce an image reference containing an attacker-controlled hostname. The client then attempted to load the image, causing a DNS request that carried CRM values in the hostname. The attack did not require the employee to click a link. The Register’s independent report also confirmed that Slack URL unfurling could provide a second path for the same type of data exfiltration. (labs.zenity.io)
The third vulnerability affected the Agentforce Reply to a Slack Thread action. The action did not require user confirmation and lacked visible attribution to the invoking user, allowing a compromised workflow to send phishing messages under the trusted agent’s identity. (theregister.com)
Salesforce Confirmed the Attack Chains Were Fixed
Zenity reported the vulnerabilities to Salesforce on June 1, 2026. Its disclosure timeline records Salesforce’s fix for the Trusted URLs bypass as confirmed on August 18, with Zenity confirming that specific fix on August 19. The Register reported that Zenity tested Salesforce’s fixes for all three vulnerabilities and confirmed them on September 21, before the public disclosure on September 24. (labs.zenity.io)
The specific SalesBleed chains therefore no longer work. The implementation risk remains relevant because the attack depended on three conditions that can exist together: unauthenticated external data entering through Web-to-Lead, an Agentforce subagent that can read both external and sensitive CRM records, and a client surface that renders or previews agent-generated URLs.
Administrators using Agentforce with Web-to-Lead or other unauthenticated data sources should review which objects and fields the relevant agent tools can query, along with Slack actions that can send messages or unfurl links. The reported exploit was patched by Salesforce, but narrowing agent access to the records required for each use case reduces the impact of future prompt-injection or output-rendering failures.
Share With Others
Platinum
