CVE-2026-26029

HighRCE

Published: 11 February 2026

Published

11 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0003 8.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26029 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 8.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-26029 is a command injection vulnerability (CWE-78) in sf-mcp-server, an implementation of the Salesforce MCP server for Claude for Desktop. The flaw arises from the unsafe use of child_process.exec when constructing Salesforce CLI commands that incorporate user-controlled input, enabling attackers to inject and execute arbitrary shell commands with the privileges of the MCP server process. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), rated as high severity.

Attackers can exploit this vulnerability remotely over the network without requiring privileges, though it demands high attack complexity and user interaction, such as tricking a user into providing malicious input through the application's interface. Successful exploitation grants attackers the ability to execute arbitrary shell commands under the context of the MCP server process, potentially leading to high confidentiality, integrity, and availability impacts, including data theft, modification, or system compromise on the host running the server.

Mitigation details are available in the project's GitHub security advisories (GHSA-h4w9-g9c5-vfwq) and a related patch commit (99fba0171b8c22b5ee3c0405053ccfd2910a066d), which security practitioners should review for remediation steps, such as updating to a patched version of sf-mcp-server.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-7019

Vulnerability details

sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to execute arbitrary…

shell commands with the privileges of the MCP server process.

CWE(s): CWE-78

AI Security AnalysisAI

AI Category: AI Agent Protocols and Integrations
Risk Domain: Protocol-Specific Risks
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: Matched keywords: claude, mcp

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Command injection via unsafe child_process.exec enables arbitrary shell command execution (T1059); client-side desktop app with UI:R requirement maps to exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1