Description
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is 4e53875aa22e8991c2fa4a7660d86e1caba66659. Applying a patch is advised to resolve this issue.
Published: 2026-08-16
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is in the fetch_pagination_url function of server.py, allowing an attacker to craft requests that cause the server to retrieve resources from arbitrary URLs. This can enable the attacker to target internal network services, perform reconnaissance, or exfiltrate sensitive data. The flaw compromises confidentiality and integrity of any internal resources accessible from the server, while also potentially creating a foothold for further internal attacks.

Affected Systems

gomarble‑ai facebook‑ads‑mcp‑server version 0.1.0 is affected. No other affected versions or vendor products are listed.

Risk and Exploitability

The CVSS score is 5.3, indicating a medium severity SSRF. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, and the vulnerability can be exploited without local access. Because the patch is available, the risk can be mitigated by applying the update.

Generated by OpenCVE AI on August 16, 2026 at 21:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch identified by commit 4e53875aa22e8991c2fa4a7660d86e1caba66659 to the facebook‑ads‑mcp‑server repository.
  • Disable or isolate any services that allow outbound connections from the server if patching cannot be performed immediately.
  • Implement network segmentation and monitor outbound traffic to detect suspicious requests originating from the server.

Generated by OpenCVE AI on August 16, 2026 at 21:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 16 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is 4e53875aa22e8991c2fa4a7660d86e1caba66659. Applying a patch is advised to resolve this issue.
Title gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery
First Time appeared Gomarble-ai
Gomarble-ai facebook-ads-mcp-server
Weaknesses CWE-918
CPEs cpe:2.3:a:gomarble-ai:facebook-ads-mcp-server:*:*:*:*:*:*:*:*
Vendors & Products Gomarble-ai
Gomarble-ai facebook-ads-mcp-server
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Gomarble-ai Facebook-ads-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-16T20:15:13.648Z

Reserved: 2026-08-16T06:07:55.366Z

Link: CVE-2026-19956

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T21:16:37.913

Modified: 2026-08-16T21:16:37.913

Link: CVE-2026-19956

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T21:30:16Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)