Tools AI Risk Radar ai-incident-0268
Incident record
Salesforce MCP tool flags can inject shell commands
- Severity
- High
- Status
- Proof-of-concept
- Type
- Infra Vuln
- Target
- sf-mcp third-party Salesforce tool server through 1.3.2
- Actor
- Researcher disclosure
- CVE
- CVE-2026-117561
What happened
Crafted flag values can pass through insufficient quoting and reach the shell used by an sf-mcp tool. This can run commands with the server process’s permissions.
The original issue was opened on 23 October and the CVE published on 27 October. The CNA lists versions through 1.3.2 and rates it High. The researcher issue remained open at review. The finding concerns this third-party MCP server; the available demonstration does not establish an attack on Salesforce’s hosted service.
Sources
- Canonical CVE recordraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- Original researcher issuegithub.com/codefriar/sf-mcp/issues/17
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026