SfdxOrgConfig breaks with Salesforce CLI May 27 2026 security update — migrate accessToken/password reads to new dedicated commands

[mayank-kumar-mishra]

Summary

Salesforce CLI is shipping a breaking change on May 27, 2026 that redacts sensitive
credentials from standard command output. CumulusCI's SfdxOrgConfig currently reads
accessToken and password directly from sf org display --json, which will stop
working after that release.

Reference: forcedotcom/cli#3560

---

What breaks

cumulusci/core/config/sfdx_org_config.py

1. sfdx_info property (line 32, 56, 60, 64–65)

p = sfdx("org display --json", self.username)
# ...
org_id = org_info["result"]["accessToken"].split("!")[0]   # line 56 — breaks
"access_token": org_info["result"]["accessToken"],         # line 60 — breaks
sfdx_info["password"] = org_info["result"]["password"]     # line 65 — breaks

[tcdahlberg]

I updated to @salesforce/cli/2.135.7 on Friday 5/22/2026 and I believe the new commands are already in place. After upgrading my cci builds are failing on " Getting org info from Salesforce CLI for..." Are other experiencing this early?

[jstvz]

Thanks for the report, @tcdahlberg and @mayank-kumar-mishra. We confirmed on our end as well.

Workaround: Set the environment variable SF_TEMP_SHOW_SECRETS=true in your shell or CI environment before running CCI. This restores the old sf org display behavior. Note: Salesforce will remove this workaround in summer 2026, so it is temporary.

export SF_TEMP_SHOW_SECRETS=true
cci flow run ...

We have a fix tracked internally (W-22684438). The permanent fix will detect the new CLI behavior and call the dedicated sf org auth show-access-token / sf org auth show-user-password commands, with graceful fallback for older CLI versions.