MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

GHSA-vf6j-c56p-cq58 · CVE-2026-25650 · PYSEC-2026-2629 · 갱신 2026. 7. 14.

해야 할 일

mcp-salesforce-connector: 0.1.10 이상으로 올리세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	mcp-salesforce-connector	0.1.10

MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

Disclosure of Salesforce OAuth bearer tokens used by the MCP.

fix applied in 0.1.10

Rotate any Salesforce tokens/credentials used by MCP-Salesforce.

MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token (GHSA-vf6j-c56p-cq58) · Sieve