Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.

Affected: npm: @contentful/mcp-server, npm: @contentful/mcp-tools

### Summary

`export_space` and `import_space` tools in `@contentful/mcp-tools` accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` / `contentful-import`. These libraries pass the merged options — including the attacker-controlled `host` — to the Contentful Management API (CMA) SDK, which builds `baseURL` from `host` and attaches the server's CMA Personal Access Token as `Authorization: Bearer <PAT>` on every outgoing request. An attacker who can invoke MCP tools, or inject instructions into Contentful content the LLM reads, can redirect all CMA requests — and the PAT — to an attacker-controlled endpoint.

---

### Details

**Root cause — `exportSpace.ts` lines 126–141** (identical pattern in `importSpace.ts` lines 103–119):

```typescript // packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts

const clientConfig = createClientConfig(config); // only extracts accessToken; discards config.host const managementToken = clientConfig.accessToken; // server's CMA PAT

const exportOptions = { ...args, // ← LLM-controlled tool call args: args.host enters here, unfiltered managementToken, // ← server PAT injected alongside attacker-controlled host environmentId: args.environmentId || 'master', exportDir: args.exportDir || process.cwd(), contentFile: args.contentFile || `contentful-export-${args.spaceId}.json`, };

const contentfulExport = await i…