CVE-2026-48039Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-06-12); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://github.com/advisories/GHSA-9gw6-46qc-99vr

Classification over time

Date	Total	Labels

2026-06-12	1	Disclosure1
2026-08-08	1	Patch1

Full discourse2 posts

Mr. OS@ksg93rd137d
Disclosure
CVE-2026-48039: Meta Ads MCP — Unauthenticated HTTP Tool Execution Leaks Operator Meta Access Token The advisory describes an MCP server where unauthenticated HTTP requests can trigger tool execution in a way that exposes the operator’s Meta access token, indicating a missing auth boundary between the network listener and token-bearing tool calls. #MCP #AgentSecurity #Advisory https://github.com/advisories/GHSA-9gw6-46qc-99vr
Post summary
The advisory describes an unauthenticated HTTP request vulnerability in Meta Ads MCP that can leak operator Meta access tokens; it provides technical details but does not claim active exploitation, offer a PoC, or mention a patch.
11011172
3.3K followersView on X
CyberSignal | Cybersecurity News@XQOPTRX80d
Patch
🔐 Critical Meta Ads MCP vulnerability exposes access tokens CVE-2026-48039 — CVSS 9.1 A flaw in the Meta Ads MCP server could allow an unauthenticated network-reachable attacker to invoke MCP tools and, under certain error conditions, expose the server operator's META_ACCESS_TOKEN. Fixed in version 1.0.109. 🔎 Source: GitHub Advisory / TheHackerWire #MCP #AISecurity #Meta #CVE #CyberSecurity
Post summary
The advisory announces CVE‑2026‑48039, a high‑severity flaw in Meta Ads MCP that may leak access tokens, and notes the vulnerability has been fixed in version 1.0.109.
0000052
34 followersView on X

Explore more

Back to dashboard