Read the docs
TI-2026-38924 Aliases CVE-2026-53957GHSA-2xhg-73j7-rrgx

Server-side request forgery in @contentful contentful-mcp-server

Priority HIGH 67CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed contentful-mcp-server (contentful): 1.7.19mcp-server (@contentful): 1.7.19+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
@contentfulcontentful-mcp-serverbefore 1.7.191.7.19Patch availableCNA
@contentfulmcp-serverbefore 1.7.191.7.19Patch availableCNA
@contentfulmcp-toolsbefore 0.4.50.4.5Patch availableCNA
—@contentful/mcp-server (npm)before 1.7.191.7.19Patch availableGHSA-2xhg-73j7-rrgx
—@contentful/mcp-tools (npm)before 0.4.50.4.5Patch availableGHSA-2xhg-73j7-rrgx
  • contentful-mcp-server Vendor@contentful Affected before 1.7.19 Fixed in 1.7.19 Patch available CNA
  • mcp-server Vendor@contentful Affected before 1.7.19 Fixed in 1.7.19 Patch available CNA
  • mcp-tools Vendor@contentful Affected before 0.4.5 Fixed in 0.4.5 Patch available CNA
  • @contentful/mcp-server (npm) Vendor— Affected before 1.7.19 Fixed in 1.7.19 Patch available GHSA-2xhg-73j7-rrgx
  • @contentful/mcp-tools (npm) Vendor— Affected before 0.4.5 Fixed in 0.4.5 Patch available GHSA-2xhg-73j7-rrgx

Remediation

  • Fix · CNA contentful-mcp-server (contentful) Fixed in 1.7.19
  • Fix · CNA mcp-server (@contentful) Fixed in 1.7.19
  • Fix · CNA mcp-tools (@contentful) Fixed in 0.4.5
  • Fix · GHSA-2xhg-73j7-rrgx @contentful/mcp-server (npm) Fixed in 1.7.19 Advisory →
  • Fix · GHSA-2xhg-73j7-rrgx @contentful/mcp-tools (npm) Fixed in 0.4.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53957
  2. 2026-10-03 Alias added: GHSA-2xhg-73j7-rrgx

References

Other 8

  • TI-2020-10383 Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences