Contentful MCP Server versions before 1.7.19 and MCP Tools before 0.4.5 contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the space-to-space migration tools. The vulnerability occurs because the export_space and import_space functions expose network options (host, proxy, rawProxy, insecure) to arguments controlled by large language models (LLMs) or attacker input. These options are combined with the server's CONTENTFUL_MANAGEMENT_TOKEN, enabling an attacker to redirect Contentful Management API requests, including the Authorization header, to attacker-controlled hosts or proxies. This can lead to persistent out-of-band access to all Contentful spaces accessible by the token. Tools that use createToolClient are not affected as they pin the host from server configuration. The vulnerability is addressed by updates to @contentful/mcp-server (1.7.19) and @contentful/mcp-tools (0.4.5).

An attacker can exploit this SSRF vulnerability to redirect authorized API requests to attacker-controlled hosts, exposing the CONTENTFUL_MANAGEMENT_TOKEN. This token exposure allows persistent unauthorized access to all Contentful spaces within the token's scope. The vulnerability does not affect availability or integrity but has a high confidentiality impact. There are no known exploits in the wild as of the published date.

Upgrade to @contentful/mcp-server version 1.7.19 or later and @contentful/mcp-tools version 0.4.5 or later to remediate this vulnerability. These versions fix the SSRF issue by restricting exposure of network options and securing the management token. No other mitigations are specified or required.