Is CVE-2026-54549 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54549 being exploited in the wild.

How severe is CVE-2026-54549?

High severity, with a CVSS score of 8.3, published 15 September 2026.

Which products and versions are affected?

meta-ads-mcp (PyPI) < 1.0.115, ECOSYSTEM:introduced=0,fixed=1.0.115.

Is there a fix for CVE-2026-54549?

Yes. meta-ads-mcp (PyPI): upgrade to 1.0.115 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54549 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54549?

Check whether you run meta-ads-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54549: pipeboard-co meta-ads-mcp SSRF in upload_ad_image

Q: Which products and versions are affected?

meta-ads-mcp (PyPI) < 1.0.115, ECOSYSTEM:introduced=0,fixed=1.0.115.

Q: Is there a fix for CVE-2026-54549?

Yes. meta-ads-mcp (PyPI): upgrade to 1.0.115 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54549 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54549?

Check whether you run meta-ads-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54549 · Severity: high · CVSS 8.3 · Published 2026-09-15

A security vulnerability exists in the meta-ads-mcp library, which is used to integrate Meta advertising tools. An attacker can trick the server into making unauthorized network requests to internal systems, such as private databases or cloud configuration services. This could allow an attacker to steal sensitive internal data or gain access to private infrastructure without needing valid credentials.

Technologies: meta-ads-mcp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54549 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54549 being exploited in the wild.
How severe is CVE-2026-54549?: High severity, with a CVSS score of 8.3, published 15 September 2026.
Which products and versions are affected?: meta-ads-mcp (PyPI) < 1.0.115, ECOSYSTEM:introduced=0,fixed=1.0.115.
Is there a fix for CVE-2026-54549?: Yes. meta-ads-mcp (PyPI): upgrade to 1.0.115 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54549 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54549?: Check whether you run meta-ads-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

meta-ads-mcp (PyPI): upgrade to 1.0.115 or later
```
pip install "meta-ads-mcp>=1.0.115"
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `upload_ad_image` MCP tool of `meta-ads-mcp` due to unrestricted use of the `image_url` parameter. The application passes this parameter directly to `httpx.AsyncClient().get()` with `follow_redirects=True` and no validation of the scheme, host, or IP address. While the server requires a Bearer token, the middleware only checks for a non-empty string, and actual Meta API credential validation occurs only after the fetch is attempted. This allows an unauthenticated attacker to probe internal network services (RFC 1918), localhost, or cloud metadata endpoints (169.254.169.254). The vulnerability is patched in version 1.0.115.

Affected products

pipeboard-co meta-ads-mcp < 1.0.115

Identifiers

CVE-2026-54549
GHSA-45gf-fjxp-cjpq
PYSEC-2026-3485

Timeline

2026-06-05: disclosed: Initial disclosure on GitHub Advisory Database
2026-07-17: advisory: Advisory updated and published
2026-07-17: patched: Fix released in version 1.0.115

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.