Contentful MCP Server advisory: two migration tools let a model redirect the server's access token to any host

An advisory published on 2026-08-19 for Contentful's first-party MCP server records CVE-2026-53957, a CWE-918 server-side request forgery rated 7.7 high. Its interest is less the class than the path: two tools handed a model direct control of where the server sent its own credentials.

The export_space and import_space tools spread their incoming arguments into the options object passed to contentful-export and contentful-import. Those options travel to the Contentful Management API SDK, which builds its baseURL from the host value and attaches the server's Management API Personal Access Token as an Authorization: Bearer header on every outgoing request. Because host and proxy were accepted from the tool call, a caller who could invoke the tool, or who could inject instructions into Contentful content the model read, could point all Management API traffic and the token at an endpoint of their choosing. The tools' own Zod schema advertised host, proxy, rawProxy and insecure to the model as ordinary optional parameters.

The advisory is precise about why the rest of the server was unaffected, and that detail is the useful part. All forty-plus regular tools obtain their client through createToolClient, which pins host: config.host ?? 'api.contentful.com' so the model cannot override it. Only these two diverged, calling a helper that extracted the access token and discarded the configured host, then spreading the raw arguments on top. The CONTENTFUL_HOST environment variable was never applied to the export options at all. Both tools are also registered disabled by default, so the documented trigger needs an enabling call first.

The remedy, in pull request #376, was to remove host, proxy and headers from both tool schemas rather than to validate them. It merged on 2026-06-01 and shipped the same day in mcp-server@1.7.19 and mcp-tools@0.4.5, eleven weeks before the advisory was published. Current releases are mcp-server@1.16.0 and mcp-tools@0.12.6, both from 2026-08-18, so anyone tracking releases received the fix well before the record described the problem.