CVE-2026-25650

HIGH SEVERITY

Vulnerability Description

MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10.

Vulnerability Details

Published Date

February 06, 2026

Last Modified

February 08, 2026

CWE ID

CWE-200

Source

NVD

Vendor

smn2gnt

Product

MCP-Salesforce

External References

https://github.com/smn2gnt/MCP-Salesforce/commit/a1e3a5a786f48508d066b6d40b58201ebf9b7fd6
https://github.com/smn2gnt/MCP-Salesforce/releases/tag/v0.1.10
https://github.com/smn2gnt/MCP-Salesforce/security/advisories/GHSA-vf6j-c56p-cq58

CVE-2026-25650

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment