CVE-2026-48039

Name of the Vulnerable Software and Affected Versions Meta Ads MCP versions prior to 1.0.109

Description Meta Ads MCP is a Model Context Protocol (MCP) server that enables AI assistants to manage Meta Ads. The AuthInjectionMiddleware.dispatch() function in http auth integration.py fails to issue a 401 response and unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers. This allows any network-reachable caller to invoke MCP tools without authentication. If no per-request credential is provided, tool handlers use the META ACCESS TOKEN environment variable. If the subsequent Meta Graph API call fails, the system serializes the raw httpx request URL—which includes the operator's access token as a query parameter—into the JSON-RPC response body, exposing the credential to the unauthenticated caller. This can lead to the exfiltration of long-lived credentials and unauthorized read or write operations on connected Meta ad accounts.

Recommendations Update Meta Ads MCP to version 1.0.109. As a temporary mitigation, return a 401 Unauthorized response in AuthInjectionMiddleware.dispatch() when neither auth token nor pipeboard token is present. In the make api request() function, strip the access token from the request url in error payloads or transmit the token via an Authorization: Bearer header instead of a URL query parameter.