CVE-2026-54547

Meta Ads MCP, a Model Context Protocol server that lets AI assistants manage Meta Ads, contains an improper authentication flaw (CWE-287) in AuthInjectionMiddleware (meta_ads_mcp/core/http_auth_integration.py) prior to version 1.0.115. The middleware only rejects HTTP MCP requests when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not treat X-Pipeboard-Token as a primary credential, so a network attacker using the streamable-http transport can supply any arbitrary X-Pipeboard-Token value to pass the guard without ever establishing an authentication context. This causes get_auth_token() to fall back to the server operator's META_ACCESS_TOKEN, allowing the attacker to invoke MCP tools that read or modify the operator's Meta Ads data under the operator's own credentials. Deployments using the default stdio transport, or running without a META_ACCESS_TOKEN configured, are not affected. The issue is fixed in version 1.0.115; no public proof of concept is known and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade Meta Ads MCP to version 1.0.115 or later. If upgrading is delayed, switch to the default stdio transport or remove the server-side META_ACCESS_TOKEN to eliminate the credential-fallback path, and restrict network access to the streamable-http endpoint. Operators who ran an exposed streamable-http deployment should review their Meta Ads accounts for unauthorized campaign, audience, or spend changes attributable to MCP tool calls.