CVE-2026-53957 Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, exportspace and importspace in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and...

CVE-2026-53957

CVE-2026-53957 affects the Contentful MCP Server (@contentful/mcp-tools and @contentful/mcp-server). The export_space and import_space tools spread LLM-controlled host, proxy, rawProxy, and insecure arguments into the options passed to the Contentful Management API SDK, which then attaches the se...

CVE-2026-53957

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:15+00:00| published-proof-of-concept| https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx...