CVE-2026-48039

Received Received - Intake

Meta Ads MCP Unauthenticated Access Token Exposure

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-48039

EUVD

EUVD-2026-54616

Affected Vendors & Products

Vendor	Product	Version / Range
pipeboard-co	meta-ads-mcp	to 1.0.109 (exc)
pipeboard-co	meta-ads-mcp	to 1.0.108 (inc)
meta	ads_mcp	1.0.109

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-48039 is a critical authentication flaw in Meta Ads MCP versions before 1.0.109. The AuthInjectionMiddleware.dispatch() function in http_auth_integration.py forwards unauthenticated Streamable HTTP requests to MCP tool handlers without rejecting them. This allows any network-reachable caller to invoke MCP tools without authentication. When no credentials are provided, the system falls back to the META_ACCESS_TOKEN environment variable. If a Meta Graph API call fails, the raw request URL containing the access token is exposed in the JSON-RPC error response, leaking the credential to the attacker.

Detection Guidance

Check if your meta-ads-mcp version is <= 1.0.108 by running: pip show meta-ads-mcp. If installed, verify if the server is listening on a network-reachable port (default 8080) using netstat -tulnp | grep 8080 or ss -tulnp | grep 8080. Inspect HTTP responses for missing 401 Unauthorized status or access tokens in error payloads.

Impact Analysis

An attacker could exploit this to execute arbitrary MCP tools, consume your Meta Ads API quota, and steal your long-lived META_ACCESS_TOKEN. This token could then be used for unauthorized access to your Meta Graph API, potentially leading to data breaches, financial loss, or misuse of your advertising account. The vulnerability requires network access to the MCP server's HTTP port (default 8080).

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Exposure of the META_ACCESS_TOKEN may result in unauthorized processing of personal data, triggering compliance breaches and potential regulatory penalties.

Mitigation Strategies

Upgrade to meta-ads-mcp version 1.0.109 or later immediately. Rotate the META_ACCESS_TOKEN environment variable and any exposed tokens. Ensure the server requires explicit Authorization: Bearer headers and blocks unauthenticated requests with 401 responses.

Hi! I’m here to help you understand CVE-2026-48039. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70