Meta Ads MCP Server Missing Authentication with Access Token Leakage

Technical Analysis

The vulnerability stems from `AuthInjectionMiddleware.dispatch()` unconditionally forwarding requests to MCP tool handlers instead of rejecting unauthenticated ones with a 401, effectively removing the auth boundary at the protocol transport layer. Absent a per-request credential, handlers silently fall back to a shared `META_ACCESS_TOKEN` environment variable, meaning a single compromised or exposed endpoint grants access to the operator's entire ad account context. On downstream Meta Graph API failures, `api.py` serializes the full `httpx` request URL—including the `access_token` query parameter—directly into the JSON-RPC response body, exfiltrating the secret to the unauthenticated caller. This crosses the tool/agent trust boundary because any AI agent or automated client capable of reaching the server's HTTP endpoint (no MCP-level credentials required) can both execute arbitrary Meta Ads actions and harvest the long-lived access token for further abuse outside the MCP session.

Affected Systems

Meta Ads MCP server; protocols: MCP

Detection Signatures

• Unauthenticated POST requests to MCP Streamable HTTP endpoint returning 200 instead of 401
• JSON-RPC error responses containing 'access_token=' query parameter in URL fields
• Outbound requests to graph.facebook.com originating from unexpected/unauthenticated MCP callers
• Environment variable META_ACCESS_TOKEN referenced in application logs or error traces
• Repeated tool invocation attempts without Authorization headers on MCP server

Remediation Steps

1. 1

   Upgrade to patched version

   Update Meta Ads MCP server to version 1.0.109 or later, which enforces authentication checks before dispatching to tool handlers.

2. 2

   Enforce 401 on missing credentials

   Ensure middleware rejects any request lacking valid per-request authentication rather than falling back to shared environment credentials.

3. 3

   Sanitize error responses

   Strip or redact sensitive query parameters (tokens, secrets) from any URLs or request metadata included in JSON-RPC error bodies or logs.

4. 4

   Rotate exposed credentials

   Immediately rotate the META_ACCESS_TOKEN and any other secrets that may have been exposed prior to patching.

5. 5

   Restrict network exposure

   Limit network reachability of the MCP server to trusted clients via network segmentation, mTLS, or API gateway authentication as defense in depth.

6. 6

   Audit access logs

   Review historical logs for unauthenticated tool invocations or leaked token strings to assess whether the vulnerability was previously exploited.