CVE-2026-54549

Meta Ads MCP, a Model Context Protocol server that lets AI assistants manage Meta ad campaigns, contains a server-side request forgery (SSRF) flaw in its upload_ad_image tool prior to version 1.0.115. The tool passes an attacker-controlled image_url to a downloader that uses httpx with follow_redirects=True and never validates the scheme, host, or resolved IP address, so the server can be directed at loopback services, private-network hosts, or cloud metadata endpoints. In streamable-http deployments the flaw is effectively unauthenticated: any non-empty Authorization header is accepted because Meta credential validation only happens after the image download. A successful attacker can read internal data, invoke state-changing internal services, or disrupt reachable services; the issue is fixed in version 1.0.115 and there is no evidence of exploitation in the wild.

What to do: Upgrade Meta Ads MCP to version 1.0.115 or later immediately. If streamable-http deployment must be used, place the server behind a real authentication layer and enforce egress rules blocking loopback, RFC1918 ranges, and the link-local cloud metadata endpoint (169.254.169.254); prefer stdio deployments where practical. Review server logs for unusual image_url fetches or redirect chains targeting internal hosts, and rotate Meta credentials if any are found.