Description

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-15T15:17:17.367Z",
  "pubdate": "2026-09-15T15:17:17.367Z",
  "executiveSummary": "The Contentful MCP Server is susceptible to a critical credential exposure vulnerability originating from improper input validation in its migration tool suite.\nThe vulnerability allows an attacker to manipulate network connection parameters—specifically host, proxy, and security settings—via LLM-controlled tool arguments.\nBy redirecting Contentful Management API requests to an attacker-controlled endpoint, the server inadvertently transmits the valid CONTENTFUL_MANAGEMENT_TOKEN to an unauthorized destination.\nThis flaw affects @contentful/mcp-server prior to version 1.7.19 and @contentful/mcp-tools prior to version 0.4.5.\nSuccessful exploitation results in full administrative access to all Contentful spaces associated with the compromised token, enabling persistent out-of-band access.\nAttackers can leverage prompt injection within Contentful content or direct MCP calls to trigger the malicious redirection, effectively bypassing intended security constraints.",
  "technicalDetails": "The root cause of this vulnerability lies in the exposure of sensitive network configuration parameters within the 'export_space' and 'import_space' functions located in 'packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts' and 'packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts'.\nUnlike the standard 'createToolClient' implementation, which correctly enforces a static host configuration derived from the server's environment, these migration tools permit LLM-controlled arguments to override 'host', 'proxy', 'rawProxy', and 'insecure' network options.\nWhen the 'space_to_space_migration_handler' enables these tools, the server combines these user-provided network overrides with the sensitive 'CONTENTFUL_MANAGEMENT_TOKEN'.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious request—either through a direct MCP call or by injecting a prompt into Contentful content that the MCP server processes. 2) The crafted payload specifies an attacker-controlled URL as the 'host' or 'proxy' parameter. 3) The Contentful MCP Server processes the migration tool invocation, initiating an outbound connection to the attacker's infrastructure while appending the Authorization header containing the legitimate 'CONTENTFUL_MANAGEMENT_TOKEN'. 4) The attacker's server captures the request, harvesting the persistent authentication token.\nThis mechanism allows an attacker to exfiltrate the token, granting them the ability to impersonate the service principal and execute arbitrary API operations across the entire Contentful account scope. Because the token is typically long-lived and scoped to multiple spaces, the impact is a total compromise of Contentful data and management capabilities.\nThe vulnerability is restricted to these specific migration tools; standard tools remain secure due to their reliance on pre-configured, immutable server-side host settings. The vulnerability exists within the application logic layer where trust is incorrectly placed in the input parameters provided to the migration job handlers."
}