Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
export_space and import_space tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — to the Contentful Management API (CMA) SDK, which builds baseURL from host and attaches the server's CMA Personal Access Token as Authorization: Bearer <PAT> on every outgoing request. An attacker who can invoke …