Contentful MCP server flaw let prompt injection steal API tokens

Contentful has fixed a vulnerability in its Model Context Protocol (MCP) server that allowed an AI agent to be tricked into sending the server's Contentful management token to an attacker-controlled host. The flaw, tracked as CVE-2026-53957, was published on 15 September 2026 and affects versions of @contentful/mcp-server before 1.7.19 and @contentful/mcp-tools before 0.4.5.

MCP is the protocol used to connect large language models to external tools. Contentful's MCP server exposes the Contentful Management API to coding assistants and other agents so they can read and change content.

According to the entry in the US National Vulnerability Database, the problem lies in two tools used for space-to-space migration: export_space and import_space. Those tools accepted host, proxy, rawProxy and insecure network options as arguments supplied by the model. The server then combined those options with its own CONTENTFUL_MANAGEMENT_TOKEN when making requests.

That combination is the whole issue. If a model can choose where a request goes, and the server attaches a credential to every request, the model can be persuaded to send the credential somewhere it should not go. The advisory says that once space_to_space_migration_handler has enabled the migration tools, either a direct MCP call or a prompt injection delivered through attacker-controlled Contentful content can redirect Contentful Management API requests, along with their Authorization header, to a host or proxy chosen by the attacker.

Prompt injection means hostile instructions hidden in data that the model reads and then follows as if they were commands from the user. In this case the data is content stored in Contentful itself, which an agent might legitimately be asked to fetch or migrate.

The advisory describes the consequences plainly. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. In other words, the stolen credential keeps working after the agent session ends, and it is not limited to the space the agent was working on. It is limited only by whatever the token itself was allowed to reach.

Not every tool in the server was affected. The NVD entry notes that the regular tools that use createToolClient are unaffected, because those tools pin the host from the server's own configuration rather than accepting it from the model. That contrast is instructive for anyone building MCP servers. Where the destination of a credentialed request is fixed by the operator, injected instructions have nothing to steer. Where it is a tool parameter, they do.

Contentful has released fixes. The issue is resolved in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, according to the advisory, which also references the upstream commit, pull request 376 and the two release tags in the contentful-mcp-server repository on GitHub.

The published record does not say whether the flaw was exploited against any real deployment, and no details of a reporter or of affected customers are given in the sources. Operators running the affected versions should upgrade, and, given that the risk here is credential exposure, treating any management token used with a vulnerable version as potentially compromised is the conservative reading of the advisory's description.