The vulnerability CVE-2026-19956 exists in gomarble-ai facebook-ads-mcp-server version 0.1.0, specifically in the fetch_pagination_url function within server.py. This flaw enables an attacker to perform server-side request forgery (SSRF), allowing the attacker to make the server send crafted requests to unintended locations. The vulnerability can be exploited remotely without user interaction and requires low privileges. A patch has been identified by the commit hash 4e53875aa22e8991c2fa4a7660d86e1caba66659 to address this issue.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the vulnerable server send arbitrary requests, potentially accessing internal resources or services not intended to be reachable externally. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

A patch identified by commit 4e53875aa22e8991c2fa4a7660d86e1caba66659 is available and should be applied to resolve this vulnerability. Since the vendor advisory or patch details are not explicitly provided, confirm patch availability and apply the official fix from the vendor or source repository referencing this commit. No other mitigation guidance is provided.