@contentful contentful-mcp-server

• CVE-2026-53957 High 7.7 Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint 0.4%