CVE-2026-26029

sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to execute arbitrary shell commands with the privileges of the MCP server process.

• CWE-78

• https://github.com/akutishevsky/sf-mcp-server/commit/99fba0171b8c22b5ee3c0405053ccfd2910a066d
• https://github.com/akutishevsky/sf-mcp-server/security/advisories/GHSA-h4w9-g9c5-vfwq
• https://github.com/akutishevsky/sf-mcp-server/security/advisories/GHSA-h4w9-g9c5-vfwq

Published

Feb 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26023Dify is an open-source LLM app development platform. Prior t…6.1
• CVE-2026-26024free5GC SMF provides Session Management Function for free5GC…7.5
• CVE-2026-26025free5GC SMF provides Session Management Function for free5GC…7.5
• CVE-2026-26026GLPI is a free asset and IT management software package. Fro…7.2
• CVE-2026-26027GLPI is a free asset and IT management software package. Fro…6.1
• CVE-2026-26028CryptPad is an end-to-end encrypted collaborative office sui…6.1
• CVE-2026-2603A flaw was found in Keycloak. A remote attacker could bypass…8.1
• CVE-2026-26030Semantic Kernel, Microsoft's semantic kernel Python SDK, has…9.9
• CVE-2026-26031Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-26032The PackagerResolver of Apache Ivy is able to download onlin…5.4
• CVE-2026-26033UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (…8.4
• CVE-2026-26034UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (…8.5