CVE-2026-48039
CriticalCVSS 9.1Summary
Meta Ads MCP prior to version 1.0.109 has a vulnerability in AuthInjectionMiddleware.dispatch() that unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable, and when the downstream Meta Graph API call fails, the JSON-RPC response body includes the raw request URL with the access token, exposing the credential to the unauthenticated caller.
Risk Assessment
An unauthenticated attacker can invoke MCP tools and obtain the Meta access token, potentially leading to unauthorized access to advertising accounts.
Recommendation
Upgrade Meta Ads MCP to version 1.0.109 or later, which includes the fix.
Original NVD description (English source)
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.