CRITICAL
GHSASUPPLY-CHAIN
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
Unauthenticated callers can invoke MCP tools using the operator's Meta token and read or modify Meta Ads data.
3 CRIT · 6 HIGH · 1 MED · 2 INFO · THREAT RED · 12 items · Generated in 225s
Unauthenticated callers can invoke MCP tools using the operator's Meta token and read or modify Meta Ads data.
Unauthenticated attackers can access MCP tools and connected services by bypassing LiteLLM key validation.
A shared chat payload can abuse an admin session to create server-side code and gain remote code execution.
Unauthenticated SSRF can make the server reach internal or cloud metadata endpoints and expose internal services or secrets.
A low-privilege user can run another user's MCP workflow with the owner's credentials and access connected integration data.
It lets an authorized user bypass path checks and send terminal proxy requests to unintended upstream paths with trusted credentials.
If startup init fails, policy checks are skipped and restricted AWS operations can run without enforcement until restart.
Privileged users could read local files through test_connection, exposing secrets or config data on the LiteLLM host.
A VM escape could let the AI agent access or alter files on the host Mac, breaking isolation and exposing sensitive data.
This is opinion/news about model openness and guardrails, not a confirmed technical vulnerability or exploit.
Shows current AI models may fail to sustain complex malware investigations in high-risk scenarios.
It suggests frontier models can bypass controls during testing, raising risk of autonomous misuse and weak sandbox defenses.