CVE-2026-48039: Pipeboard Meta Ads MCP improper authentication and token leak

CVE-2026-48039 · Severity: critical · CVSS 9.1 · Published 2026-08-07

A vulnerability in the Meta Ads MCP server allows unauthorized individuals to execute tools and access connected Meta advertising accounts without a password. If a tool execution fails, the server may also leak the administrator's long-lived Meta access token in the error message. This could lead to unauthorized ad spend, data theft, or complete takeover of the associated Meta advertising accounts.

Technologies: meta-ads-mcp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48039 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48039 being exploited in the wild.
How severe is CVE-2026-48039?
Critical severity, with a CVSS score of 9.1, published 7 August 2026.
Which products and versions are affected?
meta-ads-mcp (PyPI) <= 1.0.108, ECOSYSTEM:introduced=0,fixed=1.0.109.
Is there a fix for CVE-2026-48039?
Yes. meta-ads-mcp (PyPI): upgrade to 1.0.109 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48039 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48039?
Check whether you run meta-ads-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • meta-ads-mcp (PyPI): upgrade to 1.0.109 or later
    pip install "meta-ads-mcp>=1.0.109"

Technical details

The vulnerability consists of two primary issues: improper authentication in AuthInjectionMiddleware and sensitive information disclosure in error messages. The middleware at http_auth_integration.py:272 fails to return a 401 Unauthorized response when authentication headers are missing, allowing unauthenticated requests to reach downstream tool handlers. These handlers then fall back to using the META_ACCESS_TOKEN environment variable. If a downstream Meta Graph API call fails, the system serializes the full request URL—including the access_token query parameter—into the JSON-RPC response body. An attacker can exploit this by sending unauthenticated tool calls and capturing the returned token to gain direct access to the Meta Graph API. This is fixed in version 1.0.109.

Affected products

  • pipeboard-co meta-ads-mcp <= 1.0.108

Identifiers

  • CVE-2026-48039
  • GHSA-9gw6-46qc-99vr
  • PYSEC-2026-413

Timeline

  • 2026-05-20: disclosed: Initial disclosure to vendor
  • 2026-06-11: advisory: GitHub Advisory published
  • 2026-06-11: patched: Version 1.0.109 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.