Klue OAuth token compromise: what it means for Salesforce access control

TL;DR: A June 2026 compromise of OAuth tokens tied to Klue gave an attacker a trusted path into downstream Salesforce environments, including Commvault’s, and the affected data was limited to business relationship and sales information, according to Commvault. The incident reinforces that third-party integrations create identity and access exposure beyond the edge of the organisation.

NHIMG editorial — based on content published by Commvault covering the Klue OAuth token compromise and Salesforce exposure: security incident response and third-party integration risk

By the numbers:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.

Questions worth separating out

Q: What breaks when a third-party OAuth app is compromised?

A: A compromised OAuth app inherits whatever delegated scopes users already approved, so the attacker can act through legitimate tokens instead of noisy intrusion methods.

Q: Why do OAuth-connected third-party apps create identity risk?

A: OAuth-connected apps extend trust beyond the organisation’s own perimeter into a vendor’s security posture.

Q: How do security teams know whether secrets access is too broad?

A: A secrets model is too broad when a workload can retrieve credentials outside the service’s direct runtime needs, especially across environments or business functions.

Practitioner guidance

• Inventory all authorised SaaS integrations Create a complete list of connected applications, the data they can reach, and the business owner accountable for each integration.
• Revalidate OAuth scopes and consent records Review whether each integration still needs its current scopes, refresh tokens, and data sync permissions.
• Add token revocation and containment runbooks Define the exact steps for disabling an integration, revoking associated credentials, and confirming whether secondary credentials exist.

What's in the full analysis

Commvault's full article covers the operational detail this post intentionally leaves for the source:

• The incident response sequence used to disable the Klue integration and assess the scope of access.
• The specific categories of Salesforce data reviewed during the investigation and the limits of confirmed impact.
• The transparency and customer-guidance language the vendor used in its Trust Center updates.
• The governance steps Commvault describes for reviewing connected applications and reducing exposure over time.

👉 Read Commvault's analysis of the Klue OAuth token breach and Salesforce exposure →

Klue OAuth token compromise: what it means for Salesforce access control?

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →