—
PYSEC-2026-2629
MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token
Quick fix
PYSEC-2026-2629 — mcp-salesforce-connector: upgrade to the fixed version with the command below.
pip install --upgrade 'mcp-salesforce-connector>=0.1.10'Details
### Impact _Disclosure of Salesforce OAuth bearer tokens used by the MCP._
### Patches _fix applied in 0.1.10_
### Workarounds _Rotate any Salesforce tokens/credentials used by MCP-Salesforce._
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/mcp-salesforce-connector
Introduced in:
0Fixed in: 0.1.10Fix
pip install --upgrade 'mcp-salesforce-connector>=0.1.10'References
- https://github.com/smn2gnt/MCP-Salesforce/security/advisories/GHSA-vf6j-c56p-cq58[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-25650[ADVISORY]
- https://github.com/smn2gnt/MCP-Salesforce/commit/a1e3a5a786f48508d066b6d40b58201ebf9b7fd6[WEB]
- https://github.com/smn2gnt/MCP-Salesforce[PACKAGE]
- https://github.com/smn2gnt/MCP-Salesforce/releases/tag/v0.1.10[WEB]
- https://pypi.org/project/mcp-salesforce-connector[PACKAGE]
- https://github.com/advisories/GHSA-vf6j-c56p-cq58[ADVISORY]