CVE-2026-19956

Received Received - Intake

Server-Side Request Forgery in gomarble-ai facebook-ads-mcp-server

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulDB

Description

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is 4e53875aa22e8991c2fa4a7660d86e1caba66659. Applying a patch is advised to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-16

Last Modified

2026-08-16

Generated

2026-08-17

AI Q&A

2026-08-17

EPSS Evaluated

N/A

NVD

CVE-2026-19956

EUVD

EUVD-2026-59992

Affected Vendors & Products

Vendor	Product	Version / Range
gomarble-ai	facebook-ads-mcp-server	0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the gomarble-ai facebook-ads-mcp-server 0.1.0. It exists in the fetch_pagination_url function of server.py. An attacker can remotely manipulate this function to make unauthorized server-side requests.

Detection Guidance

This vulnerability involves a server-side request forgery (SSRF) in the gomarble-ai facebook-ads-mcp-server. Detection may involve monitoring outbound requests from the server, especially to unexpected or internal IP addresses. Check server logs for unusual requests originating from the server.py process. Inspect network traffic for connections initiated by the server to internal or external systems not part of normal operations.

Impact Analysis

This vulnerability allows remote attackers to perform unauthorized actions on the server, potentially accessing internal resources or data. It could lead to data breaches, unauthorized command execution, or network reconnaissance.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Apply the patch with commit hash 4e53875aa22e8991c2fa4a7660d86e1caba66659 to the gomarble-ai facebook-ads-mcp-server version 0.1.0 to resolve the server-side request forgery vulnerability.

Hi! I’m here to help you understand CVE-2026-19956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70