{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/contentful/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contentful MCP Tools","Contentful MCP Server"],"_cs_severities":["high"],"_cs_tags":["ssrf","llm-security","credential-theft","mcp"],"_cs_type":"advisory","_cs_vendors":["Contentful"],"content_html":"\u003cp\u003eThe Contentful MCP tools package (\u003ccode\u003e@contentful/mcp-tools\u003c/code\u003e) contains a critical vulnerability in the \u003ccode\u003eexport_space\u003c/code\u003e and \u003ccode\u003eimport_space\u003c/code\u003e functions that allows for Server-Side Request Forgery (SSRF). The vulnerability arises because these tools accept \u003ccode\u003ehost\u003c/code\u003e and \u003ccode\u003eproxy\u003c/code\u003e parameters directly from LLM-controlled input and merge them into the configuration object for the Contentful Management API (CMA) SDK.\u003c/p\u003e\n\u003cp\u003eCrucially, while the \u003ccode\u003ecreateClientConfig\u003c/code\u003e utility correctly extracts only the \u003ccode\u003eaccessToken\u003c/code\u003e for authentication, the subsequent configuration merging logic persists the user-supplied \u003ccode\u003ehost\u003c/code\u003e and \u003ccode\u003eproxy\u003c/code\u003e values. When the CMA SDK processes these options, it uses the malicious \u003ccode\u003ehost\u003c/code\u003e to construct the base URL for API requests, while automatically attaching the server's legitimate Personal Access Token (PAT) as an \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header. This allows an attacker to redirect internal CMA API calls to an attacker-controlled endpoint, effectively stealing the server's authentication credentials. This vector is accessible via direct MCP tool invocation or through prompt injection in content managed by Contentful.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker discovers that the MCP server exposes \u003ccode\u003eexport_space\u003c/code\u003e and \u003ccode\u003eimport_space\u003c/code\u003e tools (potentially via \u003ccode\u003elist_tools\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a prompt injection payload or direct MCP tool call to invoke \u003ccode\u003espace_to_space_migration_handler\u003c/code\u003e with the argument \u003ccode\u003e{ \u0026quot;action\u0026quot;: \u0026quot;enable\u0026quot; }\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe handler elevates the privileges of the migration tools, transitioning \u003ccode\u003eexport_space\u003c/code\u003e and \u003ccode\u003eimport_space\u003c/code\u003e from a disabled to an enabled state.\u003c/li\u003e\n\u003cli\u003eAttacker executes \u003ccode\u003eexport_space\u003c/code\u003e via the LLM, providing a malicious \u003ccode\u003ehost\u003c/code\u003e (e.g., \u003ccode\u003eattacker-controlled-server.com\u003c/code\u003e) and setting \u003ccode\u003einsecure: true\u003c/code\u003e to force non-encrypted transit.\u003c/li\u003e\n\u003cli\u003eThe tool merges the provided \u003ccode\u003ehost\u003c/code\u003e parameter into the \u003ccode\u003eexportOptions\u003c/code\u003e object alongside the legitimate \u003ccode\u003emanagementToken\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003econtentful-export\u003c/code\u003e module passes the merged configuration to the \u003ccode\u003econtentful-management\u003c/code\u003e SDK.\u003c/li\u003e\n\u003cli\u003eThe SDK initializes a client instance using the attacker-provided \u003ccode\u003ebaseURL\u003c/code\u003e, effectively overriding the default Contentful API endpoint.\u003c/li\u003e\n\u003cli\u003eThe SDK initiates an API request (e.g., to \u003ccode\u003e/spaces/\u003c/code\u003e) to the attacker-controlled server, including the \u003ccode\u003eAuthorization: Bearer \u0026lt;SERVER_PAT\u0026gt;\u003c/code\u003e header, resulting in credential exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to intercept the server's Personal Access Token (PAT). With this token, the attacker gains full management access to the victim's Contentful spaces and content, including the ability to read, modify, or delete sensitive data, and potentially pivot to other integrations linked to the account. This vulnerability affects Contentful MCP Tools versions below 0.4.2 and Contentful MCP Server versions below 1.7.16.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@contentful/mcp-tools\u003c/code\u003e to version 0.4.2 or higher and \u003ccode\u003e@contentful/mcp-server\u003c/code\u003e to 1.7.16 or higher immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on MCP tool arguments within the server, specifically ensuring that \u003ccode\u003ehost\u003c/code\u003e and \u003ccode\u003eproxy\u003c/code\u003e parameters are restricted to an allowlist of known Contentful API endpoints.\u003c/li\u003e\n\u003cli\u003eAudit logs for MCP tool calls where the \u003ccode\u003ehost\u003c/code\u003e parameter deviates from the expected \u003ccode\u003eapi.contentful.com\u003c/code\u003e or \u003ccode\u003ecdn.contentful.com\u003c/code\u003e domains.\u003c/li\u003e\n\u003cli\u003eRevoke and rotate any Personal Access Tokens (PATs) that may have been exposed through this vulnerable function if suspicious outgoing connections were detected from the MCP server host.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:34:19Z","date_published":"2026-08-19T22:34:19Z","id":"https://feed.craftedsignal.io/briefs/2026-08-contentful-mcp-ssrf/","summary":"The Contentful MCP tools 'export_space' and 'import_space' are vulnerable to Server-Side Request Forgery (SSRF) due to the unsafe passing of LLM-controlled 'host' and 'proxy' arguments directly to the Contentful Management API client, enabling credential exfiltration.","title":"Contentful MCP Tools SSRF via LLM-Controlled Parameters","url":"https://feed.craftedsignal.io/briefs/2026-08-contentful-mcp-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Contentful","version":"https://jsonfeed.org/version/1.1"}