Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr) - ATR-2026-01961 (7a8fce3e-c0cd-5927-af09-37cb36e974d2)

Detects CVE-2026-48039 (GHSA-9gw6-46qc-99vr, CVSS 9.1 critical, CWE-287): the meta-ads-mcp HTTP server (<=1.0.108) lets an unauthenticated POST /mcp reach the get_ad_accounts tool. AuthInjectionMiddleware.dispatch() calls call_next() without a 401, handlers fall back to the META_ACCESS_TOKEN env var, api.py appends it as access_token to the Graph API request_params, and on a failed Graph call api.py serializes the raw httpx request_url (graph.facebook.com/... &access_token=) into the JSON-RPC response body — leaking the operator token. This rule keys on the unauthenticated get_ad_accounts JSON-RPC call and on the leaked Graph API request_url that carries access_token.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr) - ATR-2026-01961 (7a8fce3e-c0cd-5927-af09-37cb36e974d2)	Agent Threat Rules	Exploit Public-Facing Application (47d73872-5336-44f7-81e3-d30bc7e039dd)	MITRE ATLAS Attack Pattern	1
Meta Ads MCP Unauthenticated Tool Execution Leaks META_ACCESS_TOKEN (CVE-2026-48039 / GHSA-9gw6-46qc-99vr) - ATR-2026-01961 (7a8fce3e-c0cd-5927-af09-37cb36e974d2)	Agent Threat Rules	Exploit Public-Facing Application - T1190 (3f886f2a-874f-4333-b794-aa6075009b1c)	Attack Pattern	1