# Unauthenticated MCP transport accepts tool calls and falls back to an ambient credential (CVE-2026-48039 / meta-ads-mcp

- **Severity:** High
- **Signature ID:** `86e8b8a7-4f76-4bdd-b99d-38df751d75b7`
- **CVEs:** CVE-2026-48039
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI03 (Identity and Impersonation), ASI07 (Unsafe Autonomous Code Execution), LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

Some MCP servers accept tool calls over the network without checking who is calling. When no per-user credential is presented, the server falls back to an operator-level access token stored in an environment variable and runs the request anyway. Anyone who can reach the server's endpoint can act with that operator's permissions.

## How the attack works

An attacker sends a tool-call request to an MCP server's Streamable-HTTP endpoint without any authentication header. The server's transport layer forwards the call instead of rejecting it with a 401. The tool handler then looks for a per-caller credential, finds none, and falls back to an ambient operator credential (for example an environment variable like META_ACCESS_TOKEN) to execute the action. The result is that an unauthenticated, network-reachable caller performs actions as the operator, such as managing ad accounts. This specific case is CVE-2026-48039 in pipeboard-co/meta-ads-mcp, fixed in version 1.0.109.

## Why it matters

An outside party can invoke privileged tools and take actions (such as changes to advertising accounts) as if they were the legitimate operator, without needing any credentials of their own.

## What you can do

- Upgrade meta-ads-mcp to 1.0.109 or later, which enforces authentication and returns 401 for unauthenticated calls.
- Audit any MCP server or gateway for tool handlers that silently fall back to an environment-variable credential when no caller credential is present; remove that fallback.
- Require and verify per-caller authentication (e.g. Authorization or API-token headers) at the transport layer before any tool call is dispatched, not just at the application layer.
- Restrict network reachability of MCP endpoints so they are not exposed to arbitrary callers, and monitor for tool calls arriving without expected auth headers.

## Known benign look-alikes

- meta-ads-mcp or MCP documentation describing the /mcp Streamable-HTTP endpoint or the META_ACCESS_TOKEN env var with no unauthenticated-exploit language
- Advisory or remediation prose referencing CVE-2026-48039 / the GHSA without exploit framing (e.g. "upgrade to 1.0.109; the fix returns 401")
- Authenticated tool-call examples carrying an Authorization or X-PIPEBOARD-API-TOKEN header
- Best-practice prose recommending that MCP transports authenticate requests, with no described exploit

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01929
- https://github.com/advisories/GHSA-9gw6-46qc-99vr
- https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.109
- https://nvd.nist.gov/vuln/detail/CVE-2026-48039

---
Source: https://www.netzilo.com/threats/atr-unauthenticated-mcp-transport-accepts-tool-calls-and-falls-b