CVE-2026-48039 pipeboard-co CVE debrief

Who should care

Defenders responsible for Meta Ads MCP deployments should assess exposure and apply version 1.0.109 or later. Roles include security engineers, DevOps teams, and administrators managing MCP tool handlers.

Why it matters

CVE-2026-48039 is a critical authentication bypass vulnerability in Meta Ads MCP. Defenders should assess exposure, prioritize remediation, and verify authentication mechanisms to prevent potential data exposure and credential misuse.

• Unauthenticated invocation of MCP tools may expose sensitive data
• Potential credential exposure through JSON-RPC response bodies
• Requires verification of authentication mechanisms for MCP tool handlers
• Necessitates review of network reachability and access controls for MCP deployments

Technical summary

The Meta Ads MCP server, prior to version 1.0.109, unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response. This allows any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable. Upon failure of the downstream Meta Graph API call, the raw httpx request URL, including the operator's access_token as a query parameter, is serialized into the JSON-RPC response body, delivering the credential to the unauthenticated caller.

Defensive priority

High

Recommended defensive actions

• Review and apply version 1.0.109 or later to address the authentication bypass
• Assess exposure of MCP tools to unauthenticated network callers
• Verify authentication mechanisms for MCP tool handlers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry detail an authentication issue in Meta Ads MCP prior to version 1.0.109. The issue allows unauthenticated callers to invoke MCP tools, potentially exposing sensitive data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.