# Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr)

- **Severity:** Critical
- **Signature ID:** `e3bba7f3-306e-4264-8ee7-57cbdcd0acec`
- **CVEs:** CVE-2026-48039
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

The meta-ads-mcp HTTP server (versions up to 1.0.108) does not require authentication before running its get_ad_accounts tool. When the underlying Facebook Graph API call fails, the server echoes back the full request URL, including the operator's access token, to whoever sent the request.

## How the attack works

An attacker sends an unauthenticated POST to /mcp invoking the get_ad_accounts tool. The server's auth middleware calls the next handler without rejecting the missing credentials, so the handler falls back to a server-side META_ACCESS_TOKEN environment variable. That token is attached to the outgoing Graph API request as an access_token parameter. If the Graph API call fails, the server serializes the raw request URL, token included, into the JSON-RPC error response, handing the attacker a working Facebook access token.

## Why it matters

Anyone who can reach the MCP endpoint can steal the operator's Meta/Facebook access token and use it to read or manage the associated ad accounts, without ever authenticating to the MCP server itself.

## What you can do

- Upgrade meta-ads-mcp past version 1.0.108 once a patched release is available, or restrict network access to the /mcp endpoint until then.
- Do not rely on a shared META_ACCESS_TOKEN environment variable for authorization; require per-request Authorization headers for tool calls.
- Audit server logs and error responses for request URLs containing access_token and rotate any Meta access token that may have been exposed.
- Put the MCP server behind network-level access controls (VPN, allowlist, or gateway auth) so it cannot be reached directly from the internet.

## Known benign look-alikes

- An authenticated meta-ads-mcp client legitimately calling get_ad_accounts with a per-request Authorization header (not relying on the env-var fallback).
- Documentation or advisory text that names get_ad_accounts or META_ACCESS_TOKEN without an actual JSON-RPC tools/call payload or a leaked request_url.
- A Graph API integration that references graph.facebook.com/me/adaccounts in code without exposing access_token in a response body.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01961
- https://nvd.nist.gov/vuln/detail/CVE-2026-48039

---
Source: https://www.netzilo.com/threats/atr-meta-ads-mcp-unauthenticated-tool-execution-leaks-meta-acces