CVE-2026-54549 Details
Description
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. This issue is fixed in version 1.0.115.
A server-side request forgery (SSRF) vulnerability has been identified in Meta Ads MCP versions prior to 1.0.115. The issue arises in the 'upload_ad_image' tool, where an attacker can manipulate the 'image_url' parameter. The vulnerability allows the server to make outbound HTTP requests to internal services, private network addresses, or cloud metadata endpoints, bypassing authorization checks. This could lead to exposure of internal data, disruption of services, or unauthorized access to sensitive information.
Users are advised to upgrade to Meta Ads MCP version 1.0.115 or later. If an earlier version was exposed on a reachable interface, review outbound request logs for unexpected internal fetches and ensure the cloud metadata service is secured.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-45gf-fjxp-cjpq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pipeboard-co/meta-ads-mcp/commit/7d9926336bbdac6285a988d043c4ccfe126c94c5 | [email protected] | Source CodeVendor |
| https://github.com/pipeboard-co/meta-ads-mcp/pull/138 | [email protected] | Issue TrackingVendor |
| https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.115 | [email protected] | Release NotesVendor |
| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-45gf-fjxp-cjpq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pipeboard-co/meta-ads-mcp | <= 1.0.114 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |