Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

meta-ads-mcp

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
1.0.128 (Sep 23, 2026): no advisory affects it
Newest unaffected release
1.0.128 (Sep 23, 2026), the latest release
Advisories
3 · 1 critical, 2 high
Weekly downloads
1,271
Dependents
0
Releases
186 since 0.1.0 (Apr 11, 2025)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

    Affected: fixed in 1.0.115.

    Fixed in 1.0.115 (released Jun 5, 2026, 102 days before disclosure).

    The latest release, 1.0.128, is not affected.

  • Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

    Affected: fixed in 1.0.115.

    Fixed in 1.0.115 (released Jun 5, 2026, 102 days before disclosure).

    The latest release, 1.0.128, is not affected.

  • CVE-2026-48039Critical 9.1

    Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

    Affected: fixed in 1.0.109.

    Fixed in 1.0.109 (released May 20, 2026, 79 days before disclosure).

    The latest release, 1.0.128, is not affected.