CVE-2026-54547
HighCVSS 7.4Summary
Meta Ads MCP prior to version 1.0.115 contains a flaw in AuthInjectionMiddleware that rejects HTTP requests only when both tokens are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A remote caller using the streamable-http transport can send any X-Pipeboard-Token value, bypass the guard, and cause the server to fall back to the operator's META_ACCESS_TOKEN.
Risk Assessment
An attacker can execute MCP tools with the operator's Meta credentials, allowing read or modification of the organization's Meta Ads data. Deployments using the default stdio transport or without META_ACCESS_TOKEN are not affected.
Recommendation
Upgrade Meta Ads MCP to version 1.0.115 or later. If possible, restrict network access to the MCP server and consider removing or rotating the META_ACCESS_TOKEN.
Other vulnerabilities in Meta Ads MCP
See all- CVE-2026-54549High
In Meta Ads MCP before 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. Fixed in version 1.0.115.
- CVE-2026-48039Critical
Meta Ads MCP prior to version 1.0.109 has a vulnerability in AuthInjectionMiddleware.dispatch() that unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable, and when the downstream Meta Graph API call fails, the JSON-RPC response body includes the raw request URL with the access token, exposing the credential to the unauthenticated caller.
Original NVD description (English source)
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A network caller using the streamable-http transport can therefore send any X-Pipeboard-Token value, pass the guard without establishing authentication context, and cause get_auth_token() to fall back to the server operator's META_ACCESS_TOKEN. Subsequent MCP tools execute with the operator's Meta credentials and can read or modify the operator's Meta Ads data. Deployments using the default stdio transport or without META_ACCESS_TOKEN are not affected. This issue is fixed in version 1.0.115.