Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token (CVE-2026-48039) | HOL Guard CVE