Executive brief
A vulnerability in the meta-ads-mcp library allows unauthorized users to bypass security checks and access sensitive Meta Ads data. By sending a specific header in a web request, an attacker can trick the system into using the server administrator's own credentials. This allows the attacker to read or modify advertising campaigns, budgets, and account details as if they were the administrator.
Technical details
The AuthInjectionMiddleware in meta-ads-mcp contains a logic flaw in its authentication guard condition. The middleware only rejects requests if both auth_token and pipeboard_token are absent. However, the extract_token_from_headers() function does not recognize the 'X-Pipeboard-Token' header, while extract_pipeboard_token_from_headers() does. By providing only the 'X-Pipeboard-Token' header, an attacker causes auth_token to be None while pipeboard_token is truthy, bypassing the 401 Unauthorized response. Because no valid user context is established, the system falls back to the META_ACCESS_TOKEN environment variable, allowing the attacker to perform privileged Meta Graph API operations. This affects deployments using the 'streamable-http' transport mode.
Affected products
- pipeboard-co meta-ads-mcp < 1.0.115
Timeline
- 2026-06-05: advisory: GitHub Advisory published
- 2026-07-17: disclosed: Vulnerability disclosed