p PatchFirst

CVE-2026-48039

CVE-2026-48039 · Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.

CVSS 9.1 · Critical · EPSS 0.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • meta-ads-mcp

    Versions
    • < 1.0.109: Affected

    No fix published

  • meta-ads-mcp PyPI

    Versions
    • 0.1.0
    • 0.10.0
    • 0.10.1
    • 0.10.2
    • 0.10.5
    • 0.10.6
    • 0.10.7
    • 0.10.9
    • 0.11.0
    • 0.11.1
    • 0.11.2
    • 0.11.3
    • 0.11.4
    • 0.11.5
    • 0.11.6
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6
    • 0.2.8
    • 0.2.9
    • 0.3.0
    • 0.3.1
    • 0.3.10
    • 0.3.2
    • 0.3.3
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.8
    • 0.3.9
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 0.4.4
    • 0.4.5
    • 0.4.6
    • 0.4.7
    • 0.4.8
    • 0.4.9
    • 0.5.0
    • 0.6.0
    • 0.7.0
    • 0.7.1
    • 0.7.10
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.7.8
    • 0.7.9
    • 0.8.0
    • 0.9.0
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 1.0.0
    • 1.0.1
    • 1.0.10
    • 1.0.100
    • 1.0.101
    • 1.0.102
    • 1.0.103
    • 1.0.104
    • 1.0.105
    • 1.0.106
    • 1.0.107
    • 1.0.108
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.15
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.19
    • 1.0.2
    • 1.0.20
    • 1.0.21
    • 1.0.22
    • 1.0.23
    • 1.0.24
    • 1.0.25
    • 1.0.26
    • 1.0.27
    • 1.0.28
    • 1.0.29
    • 1.0.3
    • 1.0.30
    • 1.0.31
    • 1.0.33
    • 1.0.34
    • 1.0.35
    • 1.0.36
    • 1.0.38
    • 1.0.39
    • 1.0.4
    • 1.0.40
    • 1.0.41
    • 1.0.42
    • 1.0.43
    • 1.0.44
    • 1.0.45
    • 1.0.46
    • 1.0.47
    • 1.0.48
    • 1.0.49
    • 1.0.5
    • 1.0.50
    • 1.0.51
    • 1.0.52
    • 1.0.53
    • 1.0.54
    • 1.0.55
    • 1.0.56
    • 1.0.57
    • 1.0.58
    • 1.0.59
    • 1.0.6
    • 1.0.60
    • 1.0.61
    • 1.0.62
    • 1.0.63
    • 1.0.64
    • 1.0.65
    • 1.0.66
    • 1.0.67
    • 1.0.68
    • 1.0.69
    • 1.0.7
    • 1.0.70
    • 1.0.71
    • 1.0.72
    • 1.0.73
    • 1.0.74
    • 1.0.75
    • 1.0.76
    • 1.0.77
    • 1.0.78
    • 1.0.79
    • 1.0.8
    • 1.0.80
    • 1.0.81
    • 1.0.82
    • 1.0.83
    • 1.0.84
    • 1.0.85
    • 1.0.86
    • 1.0.87
    • 1.0.88
    • 1.0.89
    • 1.0.90
    • 1.0.91
    • 1.0.92
    • 1.0.93
    • 1.0.94
    • 1.0.95
    • 1.0.96
    • 1.0.97
    • 1.0.98
    • 1.0.99
    Affected ranges
    • ECOSYSTEM: < 1.0.109

    Update to 1.0.109

Original sources

Check your server →