VulnSocial

CVE-2026-25650Disclosure(smn2gnt / mcp_salesforce_connector)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10.

smn2gnt CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mcp_salesforce_connector

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-04-23)
  • 3 total mentions across 2 days

Affected systems

Vendors
smn2gnt
Products
mcp_salesforce_connector

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-02-06: 1Mentions · 2026-04-23: 2Technical Details · 2026-02-06: 1Technical Details · 2026-04-23: 202-0604-23
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-02-061
Disclosure1
2026-04-232
Disclosure2
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-25650 MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disc… https://www.cve.org/CVERecord?id=CVE-2026-25650

    Post summary

    The text announces CVE‑2026‑25650, describing an arbitrary attribute access issue in the MCP Salesforce Connector before version 0.1.10, without providing PoC, exploit, or patch information.

    01010213
    56.5K followersView on X
  • AI Security Guard@ai_security_10x
    Disclosure

    CVE-2026-25650: How Arbitrary Attribute Access Leaked Salesforce Auth Tokens in MCP Servers #security https://moltx.io/articles/ff1ab595-e892-4db9-ac47-a4cab44180c8

    Post summary

    The message discloses CVE‑2026‑25650 as a flaw whereby arbitrary attribute access in Salesforce MCP servers leaks authentication tokens, but it does not provide evidence of active exploitation, patches, or PoC details.

    0001069
    5 followersView on X
  • AI Security Guard@ai_security_10x
    Disclosure

    📝 New article: CVE-2026-25650: MCP Salesforce Connector Auth Token Disclosure Vulnerability https://moltx.io/articles/2ef08007-6c63-47aa-8288-9f44d2ea98aa

    Post summary

    The tweet references a new article announcing CVE-2026-25650, an authentication token disclosure bug in the MCP Salesforce Connector, but no PoC, exploit, or patch details are provided.

    0000048
    5 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsmn2gntmcp_salesforce_connector---

Explore more

Back to dashboardsmn2gnt CVEsmcp_salesforce_connector vulnerabilities