CVE-2026-54549: Meta Ads MCP SSRF Vulnerability

CVE-2026-54549 Overview

CVE-2026-54549 is a Server-Side Request Forgery (SSRF) vulnerability in Meta Ads MCP, a Model Context Protocol (MCP) server that lets AI assistants operate Meta Ads campaigns. Versions prior to 1.0.115 pass an attacker-controlled image_url from the upload_ad_image tool into try_multiple_download_methods() without validating the URL scheme, host, or resolved IP address. The underlying httpx.AsyncClient also uses follow_redirects=True, enabling redirect-chained attacks against internal targets. The issue is classified as [CWE-918].

Critical Impact
A network caller can coerce the MCP server into reaching loopback services, private-network hosts, and cloud metadata endpoints, exposing internal data and invoking state-changing internal services.

Affected Products

Meta Ads MCP (meta-ads-mcp) versions prior to 1.0.115
Deployments exposing the server via streamable-http transport
AI assistant integrations that invoke the upload_ad_image tool

Discovery Timeline

2026-09-15 - CVE-2026-54549 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-54549

Vulnerability Analysis

The upload_ad_image tool in meta_ads_mcp/core/ads.py accepts an image_url parameter supplied by the caller. That value flows into try_multiple_download_methods() in meta_ads_mcp/core/utils.py, which issues an HTTP request using httpx.AsyncClient with redirects enabled. The download function performs no validation on the URL scheme, hostname, or the IP address that DNS resolution returns.

In a streamable-http deployment, Meta credential validation happens after the image download. An attacker can therefore supply any non-empty authorization value and still trigger the outbound request. The server acts as a confused deputy, executing HTTP calls to targets chosen by the caller.

Root Cause

The root cause is missing input validation on a user-controlled URL passed to an HTTP client [CWE-918]. Neither the scheme allowlist, host allowlist, nor post-resolution IP checks exist. The follow_redirects=True setting compounds the issue by allowing a benign-looking public URL to redirect to an internal address.

Attack Vector

An unauthenticated network caller sends an MCP request invoking upload_ad_image with an image_url pointing to an internal resource. Common targets include http://127.0.0.1, RFC1918 addresses, and cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/. The server fetches the resource, and response data or side effects reach the attacker or alter internal state.

text

# Patch metadata from the fix commit
__version__ = "1.0.114"  ->  __version__ = "1.0.115"
# fix(security): block SSRF in upload_ad_image image_url fetch (GHSA-45gf-fjxp-cjpq)

Source: GitHub Commit 7d99263

Detection Methods for CVE-2026-54549

Indicators of Compromise

Outbound HTTP requests from the Meta Ads MCP process to loopback (127.0.0.0/8), link-local (169.254.0.0/16), or RFC1918 address ranges.
MCP tool invocations of upload_ad_image where image_url targets non-public hostnames or IP literals.
Access log entries for cloud metadata endpoints originating from the MCP host.

Detection Strategies

Inspect application logs for calls into try_multiple_download_methods() with URLs that resolve to internal ranges.
Correlate upload_ad_image requests with follow-on egress traffic to unexpected internal services.
Alert on HTTP 3xx redirect chains that terminate at internal or metadata addresses.

Monitoring Recommendations

Enable egress network monitoring on hosts running MCP servers and baseline expected destinations.
Log MCP request bodies, including tool name and parameter values, for retrospective analysis.
Monitor for anomalous authorization header values combined with unusual URL parameters.

How to Mitigate CVE-2026-54549

Immediate Actions Required

Upgrade meta-ads-mcp to version 1.0.115 or later without delay.
Restrict network reachability of the MCP server so untrusted callers cannot invoke tools.
Remove or block streamable-http exposure of the MCP server on shared or public networks.

Patch Information

The fix is delivered in Meta Ads MCP 1.0.115. See the GitHub Release v1.0.115, the corrective GitHub Pull Request #138, and the GitHub Security Advisory GHSA-45gf-fjxp-cjpq for advisory details.

Workarounds

Deploy an egress proxy that blocks requests to loopback, RFC1918, and cloud metadata addresses.
Enforce authentication in front of the MCP endpoint so unauthenticated callers cannot reach upload_ad_image.
Disable the streamable-http transport where feasible until the upgrade is completed.

bash

# Upgrade Meta Ads MCP to the patched release
pip install --upgrade "meta-ads-mcp>=1.0.115"

# Verify the installed version
python -c "import meta_ads_mcp; print(meta_ads_mcp.__version__)"