Model Context Protocol Server Vulnerability in Contentful Management API

CVE-2026-53957

What is CVE-2026-53957?

The Contentful MCP Server, which serves as the Model Context Protocol server for the Contentful Management API, presents a vulnerability that allows for the exposure of sensitive configurations. Prior to the fixes implemented in versions @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, the export and import functionality of space migrations compromised the integrity of access tokens by permitting the manipulation of host and proxy settings through attacker-controlled input. This could result in unauthorized redirection of API requests, thereby facilitating potential persistent access to any Contentful space that the exposed token governs. Users are strongly advised to upgrade to the latest versions to mitigate these risks.

References