Read the docs
TI-2026-39386 Aliases CVE-2026-54547GHSA-2v2f-mvfg-ph56

Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Priority HIGH 68CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A network caller using the streamable-http transport can therefore send any X-Pipeboard-Token value, pass the guard without establishing authentication context, and cause get_auth_token() to fall back to the server operator's META_ACCESS_TOKEN. Subsequent MCP tools execute with the operator's Meta credentials and can read or modify the operator's Meta Ads data. Deployments using the default stdio transport or without META_ACCESS_TOKEN are not affected. This issue is fixed in version 1.0.115.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00518 44th percentileScored 2026-11-07
Fix Fixed meta-ads-mcp (pipeboard-co): 1.0.115meta-ads-mcp (PyPI): 1.0.115

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pipeboard-cometa-ads-mcpbefore 1.0.1151.0.115Patch availableCNA
—meta-ads-mcp (PyPI)before 1.0.1151.0.115Patch availableGHSA-2v2f-mvfg-ph56
  • meta-ads-mcp Vendorpipeboard-co Affected before 1.0.115 Fixed in 1.0.115 Patch available CNA
  • meta-ads-mcp (PyPI) Vendor— Affected before 1.0.115 Fixed in 1.0.115 Patch available GHSA-2v2f-mvfg-ph56

Remediation

  • Fix · CNA meta-ads-mcp (pipeboard-co) Fixed in 1.0.115
  • Fix · GHSA-2v2f-mvfg-ph56 meta-ads-mcp (PyPI) Fixed in 1.0.115 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54547
  2. 2026-10-03 Alias added: GHSA-2v2f-mvfg-ph56

References

Other 5

  • TI-2026-35482 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token CVSS 3.1CRITICAL 9.1
  • TI-2026-39388 Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch CVSS 3.1HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences