CVE-2026-48039: 
Python vulnerability analysis and mitigation

CVE-2026-48039 is a critical improper authentication vulnerability in the meta-ads-mcp Python package (pip) that allows unauthenticated attackers to invoke Meta Ads MCP tools and exfiltrate the operator's Meta Graph API access token. It affects all versions up to and including 1.0.108 (with confirmed vulnerable commits in ≤ 1.0.101; versions 1.0.102–1.0.105 lack git tags and patch status is unconfirmed). The vulnerability was first published by maintainer nictuku on May 20, 2026, and added to the GitHub Advisory Database on June 11, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Repo Advisory).

The vulnerability stems from three compounding weaknesses: CWE-287 (Improper Authentication), CWE-209 (Generation of Error Message Containing Sensitive Information), and CWE-522 (Insufficiently Protected Credentials). In meta_ads_mcp/core/http_auth_integration.py at line 272, AuthInjectionMiddleware.dispatch() unconditionally calls call_next(request) even when neither an Authorization: Bearer header nor an X-PIPEBOARD-API-TOKEN header is present — no 401 Unauthorized response is issued. Tool handlers then fall back to the META_ACCESS_TOKEN environment variable as an implicit credential. A second flaw in api.py at line 136 appends the access_token as a URL query parameter (request_params["access_token"] = access_token); when the downstream Meta Graph API returns an error, lines 263–269 serialize the raw httpx request URL — including the plaintext token — into the JSON-RPC 200 OK response body, delivering the operator credential to the unauthenticated caller (GitHub Advisory, Repo Advisory).

An unauthenticated, network-reachable attacker can invoke any registered MCP tool as the operator, enabling unauthorized read and write operations on connected Meta ad accounts and consuming the operator's Meta Ads API quota. If any tool call triggers a Graph API error (e.g., by using an invalid or expired token), the operator's long-lived META_ACCESS_TOKEN is returned verbatim in the request_url field of the JSON-RPC response, allowing the attacker to exfiltrate the credential and subsequently interact with the Meta Graph API directly — entirely outside the MCP interface. This creates a high confidentiality and integrity impact with no authentication barrier (GitHub Advisory, Release 1.0.109).

A public proof-of-concept is included in the official advisory, demonstrating exploitation with a single unauthenticated HTTP POST to the /mcp endpoint. No special tools, privileges, or user interaction are required — only network access to port 8080 (the default). The EPSS score is approximately 0.13% (32nd percentile), suggesting low current automated exploitation probability. No CISA KEV listing or threat actor attribution has been reported at this time (GitHub Advisory).

1. Reconnaissance: Identify internet-exposed or network-reachable instances of meta-ads-mcp running with --transport streamable-http, typically listening on port 8080. Tools like Shodan or Censys can be used to locate exposed services.
2. Confirm vulnerability: Send a minimal unauthenticated JSON-RPC request to POST /mcp with no Authorization or X-PIPEBOARD-API-TOKEN headers. A 200 OK response (rather than 401) confirms the middleware bypass.
3. Trigger a Graph API error: Invoke a tool such as get_ad_accounts with a deliberately malformed argument or rely on the server's META_ACCESS_TOKEN being invalid/expired. This causes the Graph API to return an error.
4. Extract the access token: Parse the 200 OK JSON-RPC response body for the request_url field within the error payload. The operator's META_ACCESS_TOKEN appears as a plaintext query parameter (e.g., access_token=<TOKEN>).
5. Abuse the credential: Use the exfiltrated token to make direct calls to the Meta Graph API (e.g., https://graph.facebook.com/v24.0/me/adaccounts?access_token=<TOKEN>), enabling read/write access to the operator's Meta ad accounts outside the MCP interface (GitHub Advisory, Repo Advisory).

• Network: Unexpected HTTP POST requests to /mcp on port 8080 (or configured MCP port) with no Authorization: Bearer or X-PIPEBOARD-API-TOKEN headers; outbound connections from the MCP server to graph.facebook.com triggered by unauthenticated callers.
• Logs: Application log entries containing HTTP Auth Middleware: No authentication tokens found in headers (logged as a warning at http_auth_integration.py) followed by successful tool handler execution; access logs showing POST /mcp returning 200 OK from unauthenticated source IPs.
• Response Content: JSON-RPC responses containing request_url fields with access_token= query parameters in error payloads — indicating token leakage occurred.
• Meta Graph API Logs: Unexpected or anomalous API calls to Meta Graph API endpoints (e.g., /me/adaccounts, /me/adcampaigns) from IP addresses not associated with legitimate operator infrastructure (GitHub Advisory).

Upgrade meta-ads-mcp to version 1.0.109, which fixes the vulnerability by returning 401 Unauthorized with a WWW-Authenticate: Bearer header when no valid auth header is present, and by redacting access_token and appsecret_proof from Graph API error payloads. If immediate upgrade is not possible, restrict network access to the MCP server's HTTP port (default 8080) to trusted hosts only using firewall rules. Operators who previously exposed a vulnerable version to an untrusted network should rotate the Meta access token immediately and review Meta Graph API access logs for unauthorized activity. After upgrading, HTTP clients must send Authorization: Bearer <token> on every request, as the META_ACCESS_TOKEN environment variable fallback no longer applies to HTTP transport (Release 1.0.109, Repo Advisory).

The advisory was published by the repository maintainer (nictuku) on May 20, 2026, with a detailed write-up and proof-of-concept included in the security advisory itself. The release notes for version 1.0.109 explicitly recommend that all self-hosted deployments using --transport streamable-http upgrade immediately. No significant external media coverage or notable third-party researcher commentary has been identified beyond the official advisory (Release 1.0.109, GitHub Advisory).