CVE-2026-53957
2 advisories.
npm/@contentful/mcp-server CVE-2026-53957: high 7.7, EPSS 0.41%
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
Action: Upgrade @contentful/mcp-server to 1.7.19 or later.
npm i @contentful/mcp-server@1.7.19Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.7.19 | - |
Fixed versions
| 1.7.19 |
Sources
- osv: GHSA-2xhg-73j7-rrgx
- https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx
- https://github.com/contentful/contentful-mcp-server/pull/376
- https://github.com/contentful/contentful-mcp-server/commit/fa7477ee48515f4248bc91a025eab0ca83423fe0
- https://github.com/contentful/contentful-mcp-server
- https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server%401.7.19
- https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools%400.4.5
CVE-2026-53957 · published · modified · JSON
npm/@contentful/mcp-tools CVE-2026-53957: high 7.7, EPSS 0.41%
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
Action: Upgrade @contentful/mcp-tools to 0.4.5 or later.
npm i @contentful/mcp-tools@0.4.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.4.5 | - |
Fixed versions
| 0.4.5 |
Sources
- osv: GHSA-2xhg-73j7-rrgx#npm/@contentful/mcp-tools
- https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx
- https://github.com/contentful/contentful-mcp-server/pull/376
- https://github.com/contentful/contentful-mcp-server/commit/fa7477ee48515f4248bc91a025eab0ca83423fe0
- https://github.com/contentful/contentful-mcp-server
- https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server%401.7.19
- https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools%400.4.5
CVE-2026-53957 · published · modified · JSON