Meta Ads Mcp
by Meta Ads Mcp
CVEs (2)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-54547 | hig | 0.45 | — | — | Jul 17, 2026 | ## X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token ### Summary `AuthInjectionMiddleware` in `meta-ads-mcp` rejects HTTP MCP requests only when **both** `auth_token` and `pipeboard_token` are absent. Because `extract_token_from_headers()` does not recognise the… | ||
| CVE-2026-54549 | hig | 0.45 | — | — | Jul 17, 2026 | ## Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch ### Summary The `upload_ad_image` MCP tool in `meta-ads-mcp` v1.0.113 passes an attacker-controlled `image_url` parameter directly to an HTTP fetch helper… |
- risk 0.45cvss —epss —
## X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token ### Summary `AuthInjectionMiddleware` in `meta-ads-mcp` rejects HTTP MCP requests only when **both** `auth_token` and `pipeboard_token` are absent. Because `extract_token_from_headers()` does not recognise the…
- risk 0.45cvss —epss —
## Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch ### Summary The `upload_ad_image` MCP tool in `meta-ads-mcp` v1.0.113 passes an attacker-controlled `image_url` parameter directly to an HTTP fetch helper…