CVE-2026-48039 Details
Description
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.
A critical vulnerability exists in Meta Ads MCP versions prior to 1.0.109, where the `AuthInjectionMiddleware.dispatch()` method unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers. This flaw allows any network-reachable caller to invoke MCP tools without authentication. When no per-request credentials are provided, the tool handlers default to using the `META_ACCESS_TOKEN` environment variable. If a downstream Meta Graph API call fails, the raw `httpx` request URL—containing the operator's access token as a query parameter—is serialized into the JSON-RPC response body, exposing the credential to the unauthenticated caller.
Users are advised to upgrade to Meta Ads MCP version 1.0.109 or later. After upgrading, ensure that HTTP clients send the `Authorization: Bearer <meta-access-token>` header with each request, as the environment variable fallback is no longer applicable. If an earlier version was exposed to an untrusted network, rotate the Meta access token and review Graph API access logs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-9gw6-46qc-99vr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.109 | [email protected] | Release NotesVendor |
| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-9gw6-46qc-99vr | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/pypa/advisory-database/tree/main/vulns/meta-ads-mcp/PYSEC-2026-413.yaml | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pipeboard-co Meta Ads MCP | <= 1.0.101 (semver) 0.1.0 (semver) 0.10.0 (semver) 0.10.1 (semver) 0.10.2 (semver) 0.10.5 (semver) 0.10.6 (semver) 0.10.7 (semver) 0.10.9 (semver) 0.11.0 (semver) 0.11.1 (semver) 0.11.2 (semver) 0.11.3 (semver) 0.11.4 (semver) 0.11.5 (semver) 0.11.6 (semver) 0.2.0 (semver) 0.2.1 (semver) 0.2.2 (semver) 0.2.3 (semver) 0.2.4 (semver) 0.2.5 (semver) 0.2.6 (semver) 0.2.8 (semver) 0.2.9 (semver) 0.3.0 (semver) 0.3.1 (semver) 0.3.10 (semver) 0.3.2 (semver) 0.3.3 (semver) 0.3.5 (semver) 0.3.6 (semver) 0.3.7 (semver) 0.3.8 (semver) 0.3.9 (semver) 0.4.0 (semver) 0.4.1 (semver) 0.4.2 (semver) 0.4.3 (semver) 0.4.4 (semver) 0.4.5 (semver) 0.4.6 (semver) 0.4.7 (semver) 0.4.8 (semver) 0.4.9 (semver) 0.5.0 (semver) 0.6.0 (semver) 0.7.0 (semver) 0.7.1 (semver) 0.7.10 (semver) 0.7.2 (semver) 0.7.3 (semver) 0.7.4 (semver) 0.7.5 (semver) 0.7.6 (semver) 0.7.7 (semver) 0.7.8 (semver) 1.0.2 (semver) 1.0.20 (semver) 1.0.21 (semver) 1.0.22 (semver) 1.0.23 (semver) 1.0.24 (semver) 1.0.25 (semver) 1.0.26 (semver) 1.0.27 (semver) 1.0.28 (semver) 1.0.29 (semver) 1.0.3 (semver) 1.0.30 (semver) 1.0.31 (semver) 1.0.33 (semver) 1.0.34 (semver) 1.0.35 (semver) 1.0.36 (semver) 1.0.38 (semver) 1.0.39 (semver) 1.0.4 (semver) 1.0.40 (semver) 1.0.41 (semver) 1.0.42 (semver) 1.0.43 (semver) 1.0.44 (semver) 1.0.45 (semver) 1.0.46 (semver) 1.0.47 (semver) 1.0.48 (semver) 1.0.49 (semver) 1.0.5 (semver) 1.0.50 (semver) 1.0.51 (semver) 1.0.52 (semver) 1.0.53 (semver) 1.0.54 (semver) 1.0.55 (semver) 1.0.56 (semver) 1.0.57 (semver) 1.0.58 (semver) 1.0.59 (semver) 1.0.6 (semver) 1.0.60 (semver) 1.0.61 (semver) 1.0.62 (semver) 1.0.63 (semver) 1.0.64 (semver) 1.0.65 (semver) 1.0.66 (semver) 1.0.67 (semver) 1.0.68 (semver) 1.0.69 (semver) 1.0.7 (semver) 1.0.70 (semver) 1.0.71 (semver) 1.0.72 (semver) 1.0.73 (semver) 1.0.74 (semver) 1.0.75 (semver) 1.0.76 (semver) 1.0.77 (semver) 1.0.78 (semver) 1.0.79 (semver) 1.0.8 (semver) 1.0.80 (semver) 1.0.81 (semver) 1.0.82 (semver) 1.0.83 (semver) 1.0.84 (semver) 1.0.85 (semver) 1.0.86 (semver) 1.0.87 (semver) 1.0.88 (semver) 1.0.89 (semver) 1.0.90 (semver) 1.0.91 (semver) 1.0.92 (semver) 1.0.93 (semver) 1.0.94 (semver) 1.0.95 (semver) 1.0.96 (semver) 1.0.97 (semver) 1.0.98 (semver) 1.0.99 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | New CVE Received | [email protected] |
| Aug 7, 2026 | CVE Modified | CISA-ADP |