CVE-2026-48039
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Meta Ads MCP prior to version 1.0.109 has a vulnerability in AuthInjectionMiddleware.dispatch() that unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable, and when the downstream Meta Graph API call fails, the JSON-RPC response body includes the raw request URL with the access token, exposing the credential to the unauthenticated caller.
Risk Assessment
An unauthenticated attacker can invoke MCP tools and obtain the Meta access token, potentially leading to unauthorized access to advertising accounts.
Recommendation
Upgrade Meta Ads MCP to version 1.0.109 or later, which includes the fix.
Other vulnerabilities in Meta Ads MCP
See all- CVE-2026-54549High
In Meta Ads MCP before 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. Fixed in version 1.0.115.
- CVE-2026-54547High
Meta Ads MCP prior to version 1.0.115 contains a flaw in AuthInjectionMiddleware that rejects HTTP requests only when both tokens are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A remote caller using the streamable-http transport can send any X-Pipeboard-Token value, bypass the guard, and cause the server to fall back to the operator's META_ACCESS_TOKEN.
Original NVD description (English source)
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.