TI-2026-35482 Aliases CVE-2026-48039 GHSA-9gw6-46qc-99vr

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

HIGH 80CWE-287Published 2026-08-07 · Updated 2026-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287 and CWE-209.

Summary

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00589 48th percentileScored 2026-11-07

Fix Fixed meta-ads-mcp (pipeboard-co): 1.0.109meta-ads-mcp (PyPI): 1.0.109

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pipeboard-co	meta-ads-mcp	before 1.0.109	1.0.109	Patch available	CNA
—	meta-ads-mcp (PyPI)	before 1.0.109	1.0.109	Patch available	GHSA-9gw6-46qc-99vr

meta-ads-mcp Vendorpipeboard-co Affected before 1.0.109 Fixed in 1.0.109 Patch available CNA
meta-ads-mcp (PyPI) Vendor— Affected before 1.0.109 Fixed in 1.0.109 Patch available GHSA-9gw6-46qc-99vr

Remediation

Fix · CNA meta-ads-mcp (pipeboard-co) Fixed in 1.0.109
Fix · GHSA-9gw6-46qc-99vr meta-ads-mcp (PyPI) Fixed in 1.0.109 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-48039
2026-10-03 Alias added: GHSA-9gw6-46qc-99vr

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-48039

Other 4

TI-2026-39388 Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch CVSS 3.1HIGH 8.3
TI-2026-39386 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences