HIGH 7.7 GitHub
CVE-2026-53957
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endp
### Summary
`export_space` and `import_space` tools in `@contentful/mcp-tools` accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` / `contentful-import`. These libraries pass the merged options — including the attacker-controlled `host` — to the Contentful Management API (CMA) SDK, which builds `baseURL` from `host` and attaches the server's CMA Personal Access Token as `Authorization: Bearer <PAT>` on every outgoing
Affected Products
- npm/@contentful/mcp-server < 1.7.19
- npm/@contentful/mcp-tools < 0.4.5
References
- https://github.com/advisories/GHSA-2xhg-73j7-rrgx
- https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrg
- https://github.com/contentful/contentful-mcp-server/pull/376
- https://github.com/contentful/contentful-mcp-server/commit/fa7477ee48515f4248bc91a025eab0c
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-08-19 via GitHub. Affected: npm/@contentful/mcp-server < 1.7.19, npm/@contentful/mcp-tools < 0.4.5.
vulnfeed aggregates 11672 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.