High, CVSS 7.7npmAmendedPublished
Contentful MCP Server: export_space/import_space tools pass LLM-controlled host/proxy args to CMA client, redirecting server PAT to attacker-controlled endpoint
CVE-2026-53957 · GHSA-2xhg-73j7-rrgx
- Affected
- npm @contentful/mcp-tools < 0.4.5
- Fixed in
- 0.4.5· Vendor fix available
- Issue
- exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — to the Contentful Management API (CMA) SDK, which builds baseURL from host and attaches the server's CMA Personal Access Token as Authorization: Bearer <PAT on every outgoing request. An attacker who can invoke MCP tools, or inject instructions into Contentful content the LLM reads, can redirect all CMA requests — and the PAT — to an attacker-controlled endpoint. --- Details Root cause — exportSpace.ts lines 126–141 (identical pattern in importSpace.ts lines 103–119): createClientConfig (defined in utils/tools.ts) extracts only accessToken and ignores config.host. The CONTENTFULHOST environment variable is never applied to exportOptions. The downstream chain once contentful-export receives the…
Recommended action: Upgrade to 0.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.