Contentful MCP Server advisory: two migration tools let a model redirect the server's access token to any host

GitHub's reviewed advisory record for Contentful's first-party MCP server, dated 2026-08-19, carries CVE-2026-53957, a CWE-918 server-side request forgery rated 7.7 high. The maintainer's own repository advisory under the same identifier had been public since 2026-06-12. Its interest is less the class than the path: two tools handed a model direct control of where the server sent its own credentials.

The export_space and import_space tools spread their incoming arguments into the options object passed to contentful-export and contentful-import. Those options travel to the Contentful Management API SDK, which builds its baseURL from the host value and attaches the server's Management API Personal Access Token as an Authorization: Bearer header on every outgoing request. Because host and proxy were accepted from the tool call, a caller who could invoke the tool, or who could inject instructions into Contentful content the model read, could point all Management API traffic and the token at an endpoint of their choosing. The tools' own Zod schema advertised host, proxy, rawProxy and insecure to the model as ordinary optional parameters.

The advisory is precise about why the rest of the server was unaffected, and that detail is the useful part. All forty-plus regular tools obtain their client through createToolClient, which pins host: config.host ?? 'api.contentful.com' so the model cannot override it. Only these two diverged, calling a helper that extracted the access token and discarded the configured host, then spreading the raw arguments on top. The CONTENTFUL_HOST environment variable was never applied to the export options at all. Both tools are also registered disabled by default, so the documented trigger needs an enabling call first.

The remedy, in pull request #376, was to remove host, proxy and headers from both tool schemas rather than to validate them. It merged on 2026-06-01 and shipped the same day in mcp-server@1.7.19 and mcp-tools@0.4.5, eleven days before the repository advisory and eleven weeks before GitHub's reviewed record. When this story first ran, current releases were mcp-server@1.16.0 and mcp-tools@0.12.6, both from 2026-08-18, so anyone tracking releases had the fix well before the reviewed record described the problem.

Correction, 2026-09-15: this story originally dated the advisory to 2026-08-19, which is the date of GitHub's reviewed record in the Advisory Database, and described the fix as landing eleven weeks before "the advisory." The maintainer published the repository advisory under the same GHSA identifier on 2026-06-12, eleven days after the fix. The two records also state the affected ranges differently: the repository advisory lists <= 1.7.15 and <= 0.4.1 with no patched version entered, while the reviewed record lists < 1.7.19 and < 0.4.5 with those patched versions. The mechanism, the fix commit and the fixed releases are unchanged.