Meta Ads MCP is a Model Context Protocol server enabling AI assistants to run Meta Ads. In versions before 1.0.115, the upload_ad_image tool passes an attacker-controlled image_url to a function that uses httpx.AsyncClient with follow_redirects enabled and without validating the URL scheme, host, or resolved IP address. This allows an attacker to perform SSRF attacks by directing the server to internal services such as loopback addresses, private network endpoints, or cloud metadata services. The vulnerability can lead to exposure of internal data, invocation of internal state-changing services, or disruption of reachable services. The vulnerability is addressed in version 1.0.115.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized HTTP requests to internal or protected network resources. This can result in exposure of sensitive internal data, triggering of internal services that may change state, or disruption of internal services. The CVSS 3.1 score is 8.3 (high severity), indicating significant confidentiality, integrity, and availability impacts with no required privileges or user interaction.

Upgrade to meta-ads-mcp version 1.0.115 or later, where this SSRF vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in 1.0.115.