CVE-2026-48039: Meta Ads MCP Auth Bypass Vulnerability

CVE-2026-48039 Overview

CVE-2026-48039 is an authentication bypass vulnerability in Meta Ads MCP, a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Versions prior to 1.0.109 forward unauthenticated Streamable HTTP requests directly to downstream MCP tool handlers. The AuthInjectionMiddleware.dispatch() function at http_auth_integration.py:272 fails to issue a 401 response, permitting any network-reachable caller to invoke MCP tools. When errors occur in downstream Meta Graph API calls, the response body leaks the operator's access_token. The flaw is tracked under [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated attackers on the network can invoke MCP tools and receive the operator's Meta Graph API access_token in error responses, enabling full account takeover of the associated Meta Ads workload.

Affected Products

Meta Ads MCP server (meta-ads-mcp Python package) prior to version 1.0.109
Deployments using the Streamable HTTP transport with AuthInjectionMiddleware
Environments configured with a META_ACCESS_TOKEN environment variable fallback

Discovery Timeline

2026-08-07 - CVE-2026-48039 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-48039

Vulnerability Analysis

Meta Ads MCP exposes tool handlers over a Streamable HTTP transport protected by AuthInjectionMiddleware. The middleware is expected to enforce per-request credentials before dispatching to tool logic. Instead, dispatch() at http_auth_integration.py:272 unconditionally forwards requests, regardless of whether a valid credential was supplied.

When no per-request credential is present, tool handlers fall back to reading META_ACCESS_TOKEN from the process environment. This transforms every tool invocation into an authenticated operation on behalf of the operator, executed at the request of an anonymous caller.

The secondary defect amplifies the impact. In api.py:263–269, when a downstream call to the Meta Graph API fails, the code serializes the raw httpx request URL into the JSON-RPC response body. That URL includes the access_token query parameter, so the caller receives the operator's long-lived Meta credential in the error message.

Root Cause

The root cause is missing authentication enforcement in middleware combined with unsafe error serialization. AuthInjectionMiddleware.dispatch() never rejects requests lacking credentials, and the error path echoes an outbound URL that contains a secret query parameter. Both defects reside in the same request lifecycle.

Attack Vector

An attacker reaches the MCP server over the network with no prior authentication. The attacker sends a crafted JSON-RPC tool invocation designed to force the downstream Meta Graph API call to fail, for example by requesting an invalid ad account or malformed parameter. The server responds with a serialized httpx URL containing access_token=<operator_token>. The attacker then reuses the token directly against the Meta Graph API.

See the GitHub Security Advisory GHSA-9gw6-46qc-99vr for advisory-level details.

Detection Methods for CVE-2026-48039

Indicators of Compromise

Inbound HTTP requests to the Meta Ads MCP Streamable HTTP endpoint that omit Authorization headers or per-request credentials but still receive 200 OK responses.
JSON-RPC response bodies containing graph.facebook.com URLs with an access_token= query parameter.
Meta Graph API activity originating from IP addresses that do not match the operator's known infrastructure.
Unexpected spikes in tool invocations paired with 4xx or 5xx responses from downstream Meta APIs.

Detection Strategies

Inspect application logs for MCP tool invocations that reached handler code without a resolved per-request principal.
Alert on outbound egress from the MCP host to graph.facebook.com that does not correlate with an authenticated inbound session.
Deploy content inspection on egress responses to flag JSON payloads that contain access_token= substrings.

Monitoring Recommendations

Enable verbose middleware logging around AuthInjectionMiddleware.dispatch() to record credential resolution outcomes per request.
Forward MCP server access logs and Meta Graph API audit events into a centralized data lake for correlation.
Monitor Meta Business Suite for unexpected API calls, new ad creatives, budget changes, or audience modifications.

How to Mitigate CVE-2026-48039

Immediate Actions Required

Upgrade meta-ads-mcp to version 1.0.109 or later, which fixes both the authentication bypass and the token disclosure in error paths.
Rotate the META_ACCESS_TOKEN and any Meta Graph API credentials that were configured on affected servers, since the token may already be exposed.
Restrict network access to the MCP Streamable HTTP endpoint using a firewall, reverse proxy, or private network until the patch is applied.
Review Meta Ads account audit logs for unauthorized ad activity, budget changes, or configuration modifications.

Patch Information

Version 1.0.109 of meta-ads-mcp remediates the vulnerability. The release is available at GitHub Release 1.0.109, and the ecosystem advisory is tracked in the PyPa Advisory PYSEC-2026-413.

Workarounds

Place the MCP server behind an authenticating reverse proxy that terminates unauthenticated requests before they reach AuthInjectionMiddleware.
Remove the META_ACCESS_TOKEN environment variable and require per-request credentials, eliminating the fallback that turns anonymous requests into privileged operations.
Bind the MCP server to 127.0.0.1 or a private interface so it is not reachable from untrusted networks.

bash

# Upgrade to the patched release
pip install --upgrade 'meta-ads-mcp>=1.0.109'

# Verify the installed version
pip show meta-ads-mcp | grep -i version

# Optional: remove environment fallback to force per-request auth
unset META_ACCESS_TOKEN