Executive brief
A vulnerability in the Meta Ads MCP server allows unauthorized individuals to execute tools and access connected Meta advertising accounts without a password. If a tool execution fails, the server may also leak the administrator's long-lived Meta access token in the error message. This could lead to unauthorized ad spend, data theft, or complete takeover of the associated Meta advertising accounts.
Technical details
The vulnerability consists of two primary issues: improper authentication in AuthInjectionMiddleware and sensitive information disclosure in error messages. The middleware at http_auth_integration.py:272 fails to return a 401 Unauthorized response when authentication headers are missing, allowing unauthenticated requests to reach downstream tool handlers. These handlers then fall back to using the META_ACCESS_TOKEN environment variable. If a downstream Meta Graph API call fails, the system serializes the full request URL—including the access_token query parameter—into the JSON-RPC response body. An attacker can exploit this by sending unauthenticated tool calls and capturing the returned token to gain direct access to the Meta Graph API. This is fixed in version 1.0.109.
Affected products
- pipeboard-co meta-ads-mcp <= 1.0.108
Timeline
- 2026-05-20: disclosed: Initial disclosure to vendor
- 2026-06-11: advisory: GitHub Advisory published
- 2026-06-11: patched: Version 1.0.109 released