What happened
NVD published CVE-2026-48039 (CVSS 9.1, Critical) on August 7, 2026: prior to version 1.0.109, the Meta Ads MCP server allowed any network-reachable caller to invoke MCP tools without authentication and, on error, leaked the operator's Meta access token via the JSON-RPC response.
Why it matters
MCP servers are increasingly the credential-holding bridge between LLM agents and high-value business platforms (ad accounts, billing); this flaw lets any network attacker both execute privileged ad-management actions and exfiltrate the long-lived access token needed to fully compromise the underlying Meta Ads account outside the agent context.
Attack vector
AuthInjectionMiddleware.dispatch() unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401. When no per-request credential is present, tool handlers fall back to the operator's META_ACCESS_TOKEN environment variable; on downstream Graph API failure, the raw request URL including the access_token is serialized into the JSON-RPC response body, leaking the credential to an unauthenticated caller.
Affected systems
pipeboard-co meta-ads-mcp < 1.0.109
Mitigation
Upgrade to meta-ads-mcp 1.0.109 or later (https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.109).