CVE-2026-26029: sf-mcp-server Command Injection RCE Flaw

CVE-2026-26029 Overview

CVE-2026-26029 is a command injection vulnerability affecting sf-mcp-server, an implementation of Salesforce MCP server for Claude for Desktop. The vulnerability exists due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to execute arbitrary shell commands with the privileges of the MCP server process.

Critical Impact

Attackers can achieve arbitrary shell command execution on systems running sf-mcp-server, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Affected Products

• sf-mcp-server (versions prior to the security patch)
• Claude for Desktop deployments using sf-mcp-server
• Salesforce MCP server implementations

Discovery Timeline

• 2026-02-11 - CVE-2026-26029 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26029

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The sf-mcp-server application constructs shell commands by directly incorporating user-supplied input without proper sanitization or escaping.

When the application uses Node.js's child_process.exec function to execute Salesforce CLI commands, it concatenates user-controlled data directly into the command string. This allows an attacker to inject shell metacharacters and additional commands that will be executed by the underlying operating system shell.

The attack requires network access and user interaction, but once successful, provides complete control over the MCP server process, enabling arbitrary command execution with the same privileges as the server.

Root Cause

The root cause is the unsafe construction of shell commands using string concatenation with user-controlled input, combined with the use of child_process.exec instead of safer alternatives like child_process.execFile or proper input validation and escaping mechanisms.

When user input containing shell metacharacters such as ;, |, &&, or backticks is passed to the vulnerable function, these characters are interpreted by the shell, allowing command chaining and injection of arbitrary commands.

Attack Vector

The vulnerability is exploitable over the network but requires high attack complexity and user interaction. An attacker would need to craft malicious input that gets processed by the sf-mcp-server and passed to the vulnerable child_process.exec call. The injected payload would then be executed as part of the Salesforce CLI command construction process.

For example, by including shell metacharacters in parameters expected to contain Salesforce-related data (such as organization names, query parameters, or other user-controlled fields), an attacker can break out of the intended command context and execute arbitrary commands. The vulnerability allows for full command execution with the privileges of the Node.js process running the MCP server.

For detailed technical information, refer to the GitHub Security Advisory GHSA-h4w9-g9c5-vfwq.

Detection Methods for CVE-2026-26029

Indicators of Compromise

• Unusual child process spawning from the sf-mcp-server Node.js process
• Unexpected shell commands in process execution logs containing common injection patterns (;, |, &&, backticks)
• Network connections or file system access from the MCP server process to unexpected destinations
• Log entries showing malformed Salesforce CLI commands with embedded shell metacharacters

Detection Strategies

• Monitor process trees for unexpected child processes spawned by the sf-mcp-server application
• Implement application-level logging to capture all user inputs processed by the MCP server
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to detect anomalous process behavior
• Create detection rules for shell metacharacters in API requests to the MCP server

Monitoring Recommendations

• Enable verbose logging for the sf-mcp-server application to capture all command constructions
• Monitor system calls and process executions using auditd or equivalent host-based monitoring
• Implement network traffic analysis to detect data exfiltration attempts following potential exploitation
• Review application logs regularly for signs of injection attempts or malformed inputs

How to Mitigate CVE-2026-26029

Immediate Actions Required

• Update sf-mcp-server to the patched version immediately
• Review application logs for signs of exploitation attempts
• Restrict network access to the MCP server to trusted sources only
• Implement input validation at the application perimeter as a defense-in-depth measure
• Consider temporarily disabling the service if patching cannot be performed immediately

Patch Information

A security patch has been released to address this vulnerability. The fix is available in GitHub Commit 99fba01. Organizations should upgrade to the patched version as soon as possible.

For complete details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-h4w9-g9c5-vfwq.

Workarounds

• Implement strict input validation to reject shell metacharacters before they reach the vulnerable code
• Deploy a web application firewall (WAF) or API gateway to filter malicious input patterns
• Run the sf-mcp-server process with minimal privileges to limit the impact of successful exploitation
• Use containerization or sandboxing to isolate the MCP server from critical systems

# Example: Restricting process capabilities (Linux)
# Run the sf-mcp-server with reduced privileges
setcap -r /path/to/node
sudo -u mcp-restricted-user node /path/to/sf-mcp-server