CVE-2026-25650

Katalog CVE

CVSS 7.5 · High EPSS 0,58%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada smn2gnt mcp salesforce connector. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/smn2gnt/MCP-Salesforce/security/advisories/GHSA-vf6j-c56p-cq58 advisory vendor
• https://github.com/smn2gnt/MCP-Salesforce/commit/a1e3a5a786f48508d066b6d40b58201ebf9b7fd6 patch
• https://github.com/smn2gnt/MCP-Salesforce/releases/tag/v0.1.10 release notes