{"id":"CVE-2026-54547","title":"Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads","summary":"Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_tok…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287"],"vendor":"pipeboard-co","product":"meta-ads-mcp","affected":["meta-ads-mcp < 1.0.115"],"patched":["meta-ads-mcp 1.0.115"],"published":"2026-09-15","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:16:42.293","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54547","references":[{"url":"https://github.com/pipeboard-co/meta-ads-mcp/commit/95e852793b7ff8604a8132e85d5facd08c91a36e","label":"security-advisories@github.com"},{"url":"https://github.com/pipeboard-co/meta-ads-mcp/pull/137","label":"security-advisories@github.com"},{"url":"https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.115","label":"security-advisories@github.com"},{"url":"https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56","label":"security-advisories@github.com"},{"url":"https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-2v2f-mvfg-ph56"}],"tags":["nvd","cve.org","exploit-available","ghsa","pip"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-17T16:23:11.846498Z"},"epss":0.00407,"epssPercentile":0.34681,"aliases":["GHSA-2v2f-mvfg-ph56"],"ecosystem":"pip","ingestedAt":"2026-07-17T19:14:48.432Z","slug":"CVE-2026-54547","body":"## Overview\n\nMeta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A network caller using the streamable-http transport can therefore send any X-Pipeboard-Token value, pass the guard without establishing authentication context, and cause get_auth_token() to fall back to the server operator's META_ACCESS_TOKEN. Subsequent MCP tools execute with the operator's Meta credentials and can read or modify the operator's Meta Ads data. Deployments using the default stdio transport or without META_ACCESS_TOKEN are not affected. This issue is fixed in version 1.0.115.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54547)\n\nAffected packages:\n\n- `meta-ads-mcp < 1.0.115`\n\nPatched in:\n\n- `meta-ads-mcp 1.0.115`\n\nSource: https://github.com/advisories/GHSA-2v2f-mvfg-ph56","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":206463,"id":"CVE-2026-54547","ts":1789665847123,"field":"exploit_available","old":"false","new":"true"}]}