CVE-2026-53957

Contentful MCP Server, a Model Context Protocol server for the Contentful Management API, contains a server-side request forgery flaw (CWE-918) in the export_space and import_space space-to-space migration tools. These tools pass LLM-controlled arguments such as host, proxy, rawProxy, and insecure network options into requests that carry the server's CONTENTFUL_MANAGEMENT_TOKEN, so once the migration tools are enabled via space_to_space_migration_handler, either a direct MCP call or a prompt injection embedded in attacker-controlled Contentful content can redirect the request and its Authorization header to an attacker-controlled host or proxy. Successful exploitation leaks the personal access token, granting persistent out-of-band access to every Contentful space within that token's scope; the regular tools that use createToolClient are unaffected because they pin the host from server configuration. Users of @contentful/mcp-server before 1.7.19 and @contentful/mcp-tools before 0.4.5 are affected. No public proof of concept exists and no exploitation in the wild is known.

What to do: Upgrade to @contentful/mcp-server 1.7.19 or later and @contentful/mcp-tools 0.4.5 or later. Rotate any CONTENTFUL_MANAGEMENT_TOKEN used with affected versions, since a leaked token grants persistent access to all spaces in its scope, and prefer narrowly scoped tokens going forward. Review Contentful API audit logs for unexpected activity, and avoid enabling the space_to_space_migration_handler tools on servers that process untrusted Contentful content.