What is GHSA-vf6j-c56p-cq58?

GHSA-vf6j-c56p-cq58 is a security advisory published by GitHub Security Advisories with High severity. MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

Which CVE IDs does GHSA-vf6j-c56p-cq58 cover?

GHSA-vf6j-c56p-cq58 covers the following CVE IDs: CVE-2026-25650. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-vf6j-c56p-cq58?

GHSA-vf6j-c56p-cq58 affects 1 product, including: pip/mcp-salesforce-connector:\u003c 0.1.10.

GHSA-vf6j-c56p-cq58High

MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

Vendor

GitHub Security Advisories

Published

February 6, 2026

Last Modified

February 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-25650 →

📋 Description

Impact

Disclosure of Salesforce OAuth bearer tokens used by the MCP.

Patches

fix applied in 0.1.10

Workarounds

Rotate any Salesforce tokens/credentials used by MCP-Salesforce.

🎯 Affected products1

pip/mcp-salesforce-connector:< 0.1.10

🔗 References (5)

https://github.com/smn2gnt/MCP-Salesforce/security/advisories/GHSA-vf6j-c56p-cq58
https://github.com/smn2gnt/MCP-Salesforce/commit/a1e3a5a786f48508d066b6d40b58201ebf9b7fd6
https://nvd.nist.gov/vuln/detail/CVE-2026-25650
https://github.com/smn2gnt/MCP-Salesforce/releases/tag/v0.1.10
https://github.com/advisories/GHSA-vf6j-c56p-cq58