{
 "id": "AIR-2026-0957",
 "slug": "cve-2026-25650-mcp-salesforce-connector-auth-token-disclosur",
 "title": "CVE-2026-25650: MCP Salesforce Connector Auth Token Disclosure Vulnerability",
 "summary": "An arbitrary attribute access vulnerability exists in the MCP Salesforce Connector prior to version 0.1.10. Exploitation allows the disclosure of Salesforce authentication tokens, which has been resolved in the patched release.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "data_leak"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "MCP Salesforce Connector"
 ],
 "incident_date": "2026-02-06",
 "incident_date_precision": "day",
 "first_reported": "2026-02-06",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25650",
   "publisher": "NVD",
   "title": "CVE-2026-25650: MCP Salesforce Connector is a Model Context Protocol (MCP) server implementation for Salesforce integration.",
   "published_at": "2026-02-06"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-25650",
  "mcp",
  "salesforce"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}