The MCP Salesforce Connector allows arbitrary attribute access, enabling a malicious actor to read internal attributes that contain a Salesforce authentication token. This token can be used to impersonate a Salesforce account, potentially granting unauthorized access to data, configurations, and API operations. As this flaw exposes a credential, it is categorized as an information exposure vulnerability.

The vulnerability affects the MCP Salesforce Connector published by smn2gnt. All releases prior to version 0.1.10 are impacted. The fix was introduced in the 0.1.10 release, released on GitHub. Any deployment of the connector older than 0.1.10 should be considered exposed.

The CVSS score is 6.6, indicating moderate severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through an attacker who can query the MCP server’s attributes—either remotely if the service is exposed or internally if the attacker has access to the system. While exploitation is currently unlikely, the disclosed token could be valuable to an adversary who has other footholds. Prompt patching is recommended to eliminate the risk.