PHP2Shell : See if you’re affected with a free external attack surface scan. Click Here > 

Back
New CVE Detected

CVE-2026-54549 – SSRF via upload_ad_image – Meta Ads MCP (meta-ads-mcp) < 1.0.115

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-54549 is a Server-Side Request Forgery (SSRF) vulnerability in Meta Ads MCP (the meta-ads-mcp PyPI package by pipeboard-co), a Model Context Protocol server used to interact with Meta’s advertising APIs. The upload_ad_image MCP tool accepts an attacker-controlled image_url parameter and passes it directly to an HTTP fetch routine without validating the scheme, hostname, or resolved IP address, allowing unauthenticated remote attackers to force the server to issue requests to arbitrary internal or cloud-internal targets. The issue has a CVSS v3.1 base score of 8.3 (High).

Technical details

  • Root cause: The fetch helper functions in meta_ads_mcp/core/utils.py lack scheme, host, and IP-address validation before requesting a caller-supplied image_url.
  • Compounding issue: The server’s authentication middleware only checks that a non-empty Bearer token is present; the actual credential/authorization check happens only after the outbound image download has already completed, so the SSRF request fires regardless of whether the token is valid.
  • Unsafe HTTP client configuration: The server uses httpx.AsyncClient(follow_redirects=True) with no restrictions on redirect targets, enabling attackers to bypass simple allow-list checks via HTTP redirects to internal addresses.
  • Trigger conditions: An attacker sends a crafted MCP request invoking the upload_ad_image tool with an image_url pointing at localhost, an RFC 1918 private address, or a cloud metadata endpoint.
  • Attack vector: Network, no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N).
  • Impact: The server can be coerced into issuing requests to localhost services and admin interfaces, private/internal network hosts, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), and internal microservices or Kubernetes control planes — potentially exposing sensitive internal data or credentials returned in the fetch response.

Affected software

  • Product: Meta Ads MCP (meta-ads-mcp, pipeboard-co)
  • Affected versions: All versions prior to 1.0.115
  • Fixed version: 1.0.115

Severity

  • CVSS v3.1 Base Score: 8.3 (High)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Mitigation and recommended actions

  • Immediate: Upgrade meta-ads-mcp to version 1.0.115 or later, which fixes the SSRF flaw.
  • If immediate patching is not possible:
    • Restrict outbound network connections from the MCP server host to only required external destinations, blocking access to localhost, RFC 1918 private ranges, and cloud metadata IP ranges (e.g., 169.254.169.254).
    • Enforce URL/hostname/IP allow-listing or block-listing for any tool that accepts remote URLs before the request is issued.
    • Ensure authentication/authorization checks complete and are validated before any outbound request is made, not after.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge