What happened
NVD published CVE-2026-19956 (CVSS 6.3, Medium) on 2026-08-16, describing a server-side request forgery (SSRF) vulnerability in the pagination-URL-following logic of the facebook-ads-mcp-server, an MCP tool server that exposes Facebook Ads Graph API functionality to LLM agents. The vulnerability is remotely exploitable and was patched upstream.
Why it matters
MCP servers are increasingly wired directly into agent tool-use pipelines with elevated network and credential access; an SSRF in a tool-calling MCP server lets an attacker pivot the agent's own network position to reach internal services, cloud metadata endpoints, or other systems the agent's host would not otherwise expose — a now-familiar pattern across many MCP-based tool integrations in 2026.
Attack vector
The fetch_pagination_url function in server.py of this Model Context Protocol (MCP) server — which lets AI agents query Facebook Ads reporting data — fails to validate the pagination URL parameter before making a server-side HTTP request. A remote attacker can supply a crafted pagination URL to force the MCP server to make requests to attacker-controlled or internal network endpoints (e.g. cloud metadata services, internal admin APIs) on behalf of the AI agent process.
Affected systems
gomarble-ai/facebook-ads-mcp-server 0.1.0
Mitigation
Patched via commit 4e53875aa22e8991c2fa4a76… in the gomarble-ai/facebook-ads-mcp-server GitHub repository; upgrade to the patched version and add allow-list validation for any URL/host passed into pagination-following logic.