CVSS 4.0
6.6 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:UCVE-2026-25650
Medium (6.6) in smn2gnt mcp salesforce connector. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in mcp-salesforce-connector 0.1.10.
MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- smn2gnt:mcp_salesforce_connector
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vf6j-c56p-cq58 | PyPI | mcp-salesforce-connector | <0.1.10 | 0.1.10 |
| PYSEC-2026-2629 | PyPI | mcp-salesforce-connector | <0.1.10 | 0.1.10 |