CVE-2026-19956 is an SSRF in the facebook-ads-mcp-server's fetch_pagination_url function, and the CVSS 6.3 rating fundamentally misrepresents its actual risk. This is not a conventional medium-severity SSRF — it exists in a Model Context Protocol server that AI agents query autonomously with implicit trust. When an AI agent requests Facebook Ads data, it operates under the assumption that any URL the MCP server fetches and returns is legitimate. An SSRF in pagination handling breaks that trust chain and turns the agent itself into an unwitting attack vehicle.
The vulnerability carries compounding risk beyond typical SSRF. Pagination URLs in advertising APIs are frequently derived from upstream response payloads — if an attacker can influence ad account data or API responses, they can inject malicious URLs that the MCP server blindly dereferences. Because MCP servers maintain persistent context and credentials, downstream requests inherit authenticated access to whatever internal services the host can reach. The AI agent then processes returned data and takes downstream actions — generating reports, adjusting bids, triggering spend — becoming an active distributor of attacker-manipulated outputs rather than a passive data leak vector.
The patch commit 4e53875aa22e8991c2fa4a7660d86e1caba66659 likely adds URL validation, but verify whether it implements strict allowlisting of Facebook domains or relies on weaker heuristics that could permit redirection to attacker-controlled domains. The more critical architectural gap is the absence of a provenance chain: MCP servers return data as if it originated from the expected upstream, with no mechanism for the calling agent to validate authenticity.
Prioritize remediation differently than a traditional SSRF. Beyond applying the patch, consider flushing agent working memory and re-establishing trust chains for any session that touched the vulnerable function — contaminated context persists in the agent's reasoning even after the code is patched. If this server operates in multi-tenant environments, the risk elevates significantly: an attacker's injected URLs could yield data fed to agents acting on behalf of different tenants, creating lateral movement through agentic reasoning chains rather than infrastructure.