Contentful MCP Server Token Exfiltration via Configurable Host/Proxy Parameters
First seen Sep 16, 2026 · Updated Sep 16, 2026 · CVSS 7.7
The Contentful MCP Server's export_space and import_space tools allowed LLM-controlled arguments (host, proxy, rawProxy, insecure) to redirect Contentful Management API traffic, including the Authorization header carrying the server's management token, to an attacker-controlled endpoint. This could be triggered either by a direct malicious MCP tool call or via prompt injection embedded in attacker-controlled Contentful content, resulting in persistent theft of a token with access to all spaces in its scope. The issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.
Technical Analysis
The migration tools (export_space/import_space) built their HTTP client using LLM-supplied parameters rather than pinning the host from server configuration like the rest of the toolset (createToolClient). Because the CONTENTFUL_MANAGEMENT_TOKEN is attached as an Authorization header to requests built from these attacker-influenceable parameters, an attacker who can either call the MCP tool directly or inject instructions through untrusted Contentful content (e.g., a poisoned entry field later read by the agent) can cause the agent to route the authenticated request to a host/proxy they control. This crosses the tool-to-network boundary: the LLM's tool-call arguments directly control network destination and TLS validation (via the insecure flag), turning a content-level prompt injection into infrastructure-level credential exfiltration. The attacker gains a long-lived personal access token, enabling persistent out-of-band access to every Contentful space within that token's scope, independent of the original agent session.
Affected Systems
@contentful/mcp-server, @contentful/mcp-tools; protocols: MCP
Detection Signatures
- MCP tool calls to export_space/import_space containing non-default 'host', 'proxy', 'rawProxy', or 'insecure' parameters
- Outbound Contentful Management API requests to hosts other than api.contentful.com
- Authorization headers containing Contentful management tokens sent to unexpected domains
- Contentful content fields containing embedded instructions referencing proxy/host overrides or urging tool reconfiguration
- Use of @contentful/mcp-server < 1.7.19 or @contentful/mcp-tools < 0.4.5
Remediation Steps
- 1
Upgrade affected packages
Update to @contentful/mcp-server 1.7.19+ and @contentful/mcp-tools 0.4.5+ where host/proxy options are no longer LLM-controllable for migration tools.
- 2
Pin network destinations server-side
Ensure all tool clients derive host/proxy configuration solely from trusted server-side config, never from LLM/tool-call arguments, mirroring the pattern used by createToolClient.
- 3
Restrict/disable migration tools by default
Disable space_to_space_migration_handler and related export/import tools unless explicitly required, and gate them behind additional confirmation or allowlists.
- 4
Sanitize untrusted content before agent ingestion
Treat Contentful entry content as untrusted input; strip or neutralize embedded instructions before passing to the LLM to reduce prompt injection risk.
- 5
Rotate and scope tokens
Rotate CONTENTFUL_MANAGEMENT_TOKEN, scope tokens to minimum necessary spaces, and monitor for anomalous API usage from unfamiliar IPs/hosts.
- 6
Enforce TLS validation
Disallow the 'insecure' flag entirely or require it be locked to false in production deployments.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.