{"id":"CVE-2026-53957","title":"Contentful MCP Server is a Model Context Protocol server for the Contentful Management API","summary":"Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"contentful","product":"contentful-mcp-server","affected":["contentful-mcp-server < 1.7.19","mcp-server < 1.7.19","mcp-tools < 0.4.5"],"patched":["@contentful/mcp-server 1.7.19","@contentful/mcp-tools 0.4.5"],"published":"2026-09-15","updated":"2026-09-17","sourceUpdated":"2026-09-17T15:16:47.593","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53957","references":[{"url":"https://github.com/contentful/contentful-mcp-server/commit/fa7477ee48515f4248bc91a025eab0ca83423fe0","label":"security-advisories@github.com"},{"url":"https://github.com/contentful/contentful-mcp-server/pull/376","label":"security-advisories@github.com"},{"url":"https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server@1.7.19","label":"security-advisories@github.com"},{"url":"https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools@0.4.5","label":"security-advisories@github.com"},{"url":"https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx","label":"security-advisories@github.com"},{"url":"https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server%401.7.19"},{"url":"https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools%400.4.5"},{"url":"https://github.com/advisories/GHSA-2xhg-73j7-rrgx"}],"tags":["nvd","cve.org","exploit-available","ghsa","npm"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T14:31:40.554851Z"},"epss":0.00249,"epssPercentile":0.16521,"aliases":["GHSA-2xhg-73j7-rrgx"],"ecosystem":"npm","ingestedAt":"2026-08-19T19:44:03.171Z","slug":"CVE-2026-53957","body":"## Overview\n\nContentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-53957)\n\nAffected packages:\n\n- `@contentful/mcp-server < 1.7.19`\n- `@contentful/mcp-tools < 0.4.5`\n\nPatched in:\n\n- `@contentful/mcp-server 1.7.19`\n- `@contentful/mcp-tools 0.4.5`\n\nSource: https://github.com/advisories/GHSA-2xhg-73j7-rrgx","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":42.4,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":206148,"id":"CVE-2026-53957","ts":1789658475355,"field":"exploit_available","old":"false","new":"true"}]}