CVE-2026-25650 MEDIUM

CVE-2026-25650: MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token

Vendor Smn2Gnt

Product MCP-Salesforce

Weakness CWE-200 · Info exposure

Published February 6, 2026

Last update February 9, 2026

View on NVD All CVEs

CVSS base score

6.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10.

Key dates

02Disclosure timeline

February 6, 2026 CVE published

February 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-25650 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

CVE-2026-25650: MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token

01Description

02Disclosure timeline

03References

04Related CVE