Meta Ads MCP vulnerabilities

In Meta Ads MCP before 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. Fixed in version 1.0.115.

Meta Ads MCP prior to version 1.0.115 contains a flaw in AuthInjectionMiddleware that rejects HTTP requests only when both tokens are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A remote caller using the streamable-http transport can send any X-Pipeboard-Token value, bypass the guard, and cause the server to fall back to the operator's META_ACCESS_TOKEN.

Meta Ads MCP prior to version 1.0.109 has a vulnerability in AuthInjectionMiddleware.dispatch() that unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable, and when the downstream Meta Graph API call fails, the JSON-RPC response body includes the raw request URL with the access token, exposing the credential to the unauthenticated caller.