CVE-2026-53957High· 7.7▾ MidnightPoC available

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 42.4 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 15, 2026

Updated

Sep 17, 2026

CVSS

7.7

Vendor

contentful

Product

contentful-mcp-server

CWE

CWE-918

Depth score

54 · Moderate

EPSS

0.25% · p17

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

decided 2026-09-17

Exploitation: poc
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 17.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 3 days

Sep 15, 2026Published
Disclosed via NVD
Sep 17, 2026Record revised
Last analysed / modified upstream
Sep 17, 2026EPSS first tracked
0.2%
Sep 17, 2026Public exploit observed
Exploit / PoC code exists

contentful CWE-918 #nvd #cve.org #exploit-available #ghsa #npm

Affected

contentful-mcp-server < 1.7.19
mcp-server < 1.7.19
mcp-tools < 0.4.5

Patched in

@contentful/mcp-server 1.7.19
@contentful/mcp-tools 0.4.5

Full technical detail▾

Overview

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-53957)

Affected packages:

@contentful/mcp-server < 1.7.19
@contentful/mcp-tools < 0.4.5

Patched in:

@contentful/mcp-server 1.7.19
@contentful/mcp-tools 0.4.5

Source: https://github.com/advisories/GHSA-2xhg-73j7-rrgx

References

Change history

Field changes observed since this record was first indexed.

Sep 17, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#exploit-available#ghsa#npm

← Back to feed