CVE-2026-25650
Arbitrary Attribute Access in MCP Salesforce Connector Exposes Auth Token
Publication date: 2026-02-06
Last updated on: 2026-02-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| smn2gnt | mcp_salesforce_connector | to 0.1.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25650 is a vulnerability in the MCP Salesforce Connector, a server implementation for Salesforce integration. Prior to version 0.1.10, the connector allowed arbitrary attribute access which could lead to the disclosure of Salesforce authentication tokens.
This means that unauthorized users could potentially access sensitive Salesforce OAuth bearer tokens due to insufficient input validation in the connector.
The vulnerability was fixed in version 0.1.10 by adding stricter validation checks on Salesforce object references to prevent invalid or malicious access.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of Salesforce authentication tokens, which are sensitive credentials used to access Salesforce APIs.
If exploited, attackers could gain unauthorized access to Salesforce data and services by using the exposed tokens, potentially leading to data breaches or manipulation of Salesforce resources.
Users of the MCP Salesforce Connector prior to version 0.1.10 are advised to update to the fixed version and rotate any exposed Salesforce tokens or credentials to mitigate the risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade the MCP Salesforce Connector to version 0.1.10 or later, where the issue has been fixed.
Additionally, rotate any Salesforce OAuth bearer tokens or credentials used by the MCP-Salesforce connector to prevent potential misuse due to token disclosure.