Executive brief
A security vulnerability exists in the meta-ads-mcp library, which is used to integrate Meta advertising tools. An attacker can trick the server into making unauthorized network requests to internal systems, such as private databases or cloud configuration services. This could allow an attacker to steal sensitive internal data or gain access to private infrastructure without needing valid credentials.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `upload_ad_image` MCP tool of `meta-ads-mcp` due to unrestricted use of the `image_url` parameter. The application passes this parameter directly to `httpx.AsyncClient().get()` with `follow_redirects=True` and no validation of the scheme, host, or IP address. While the server requires a Bearer token, the middleware only checks for a non-empty string, and actual Meta API credential validation occurs only after the fetch is attempted. This allows an unauthenticated attacker to probe internal network services (RFC 1918), localhost, or cloud metadata endpoints (169.254.169.254). The vulnerability is patched in version 1.0.115.
Affected products
- pipeboard-co meta-ads-mcp < 1.0.115
Timeline
- 2026-06-05: disclosed: Initial disclosure on GitHub Advisory Database
- 2026-07-17: advisory: Advisory updated and published
- 2026-07-17: patched: Fix released in version 1.0.115