Meta Ads MCP Authentication Bypass via X-Pipeboard-Token
First seen Sep 17, 2026 · Updated Sep 17, 2026 · CVSS 7.4
A flaw in the Meta Ads MCP server's authentication middleware allows a remote attacker to bypass credential checks by supplying an arbitrary X-Pipeboard-Token value over the streamable-HTTP transport. This causes the server to silently fall back to the operator's own META_ACCESS_TOKEN, letting an unauthenticated caller execute MCP tools with the operator's real Meta Ads privileges. Deployments using stdio transport or lacking a configured META_ACCESS_TOKEN are not affected.
Technical Analysis
AuthInjectionMiddleware only rejects requests when both auth_token and pipeboard_token are missing, but extract_token_from_headers() fails to treat X-Pipeboard-Token as a valid primary credential requiring verification. An attacker sends any non-empty X-Pipeboard-Token header, satisfying the presence check without establishing a legitimate auth context. get_auth_token() then falls through to the server operator's configured META_ACCESS_TOKEN, and all subsequent MCP tool calls execute with that operator identity against the Meta Ads API. This crosses the trust boundary between an unauthenticated network caller and a privileged backend credential, enabling read/write access to the operator's ad accounts, campaigns, and billing data.
Affected Systems
Meta Ads MCP; protocols: MCP
Detection Signatures
- HTTP requests to MCP streamable-http endpoint containing X-Pipeboard-Token header with unrecognized or arbitrary values
- Absence of corresponding pipeboard session/auth validation in logs prior to tool execution
- MCP tool invocations succeeding without prior valid auth_token exchange
- Unexpected Meta Ads API calls originating from server-side META_ACCESS_TOKEN outside expected client sessions
Remediation Steps
- 1
Upgrade Meta Ads MCP
Update to version 1.0.115 or later, which fixes the token validation and fallback logic.
- 2
Validate all credential headers
Ensure extract_token_from_headers() and equivalent logic explicitly validate X-Pipeboard-Token against issued sessions rather than treating its mere presence as sufficient.
- 3
Restrict HTTP transport exposure
Where possible, prefer stdio transport or place streamable-http endpoints behind network-level authentication (mTLS, VPN, API gateway) to limit unauthenticated network access.
- 4
Avoid operator-token fallback
Do not allow silent fallback to a shared operator-level META_ACCESS_TOKEN when client-specific authentication fails; fail closed instead.
- 5
Audit access logs
Review historical MCP request logs for anomalous X-Pipeboard-Token usage and unexpected tool calls indicating prior exploitation.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.