{
 "id": "AIR-2026-0116",
 "slug": "cve-2026-54549-meta-ads-mcp-unvalidated-image-url-vulnerabil",
 "title": "CVE-2026-54549: Meta Ads MCP Unvalidated Image URL Vulnerability",
 "summary": "A vulnerability in Meta Ads MCP permits unvalidated image URL downloads via an asynchronous HTTP client without scheme or host verification. Network callers can leverage this flaw to perform unauthorized requests.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Meta Ads MCP"
 ],
 "incident_date": "2026-09-15",
 "incident_date_precision": "day",
 "first_reported": "2026-09-15",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54549",
   "publisher": "NVD",
   "title": "CVE-2026-54549: Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads.",
   "published_at": "2026-09-15"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-54549",
  "mcp",
  "ssrf"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}