CVE-2026-46555
WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
Description
WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files.
INFO
Published Date :
July 20, 2026, 5:17 p.m.
Last Modified :
Oct. 24, 2026, 8:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Upgrade to whatsapp-mcp v0.2.1 or later.
- Configure bearer token authentication for the HTTP API.
- Implement host header allow-list validation.
- Confinement of media_path to a configured directory.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46555.
| URL | Resource |
|---|---|
| https://github.com/verygoodplugins/whatsapp-mcp/blob/main/SECURITY.md | Issue Tracking |
| https://github.com/verygoodplugins/whatsapp-mcp/releases/tag/v0.2.1 | Product Release Notes |
| https://github.com/verygoodplugins/whatsapp-mcp/security/advisories/GHSA-7jj9-4qqq-4xc4 | Mitigation Patch Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46555 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46555
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46555 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46555 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: whatsapp-mcp de verygoodplugins, Description: El Servidor MCP de WhatsApp es un servidor de Protocolo de Contexto de Modelo (MCP) para WhatsApp, que permite a Claude leer y enviar mensajes de WhatsApp. Antes de la versión 0.2.1, la API HTTP ’whatsapp-bridge’ escucha en ’127.0.0.1:8080’ sin autenticación y sin validación del encabezado Host, y el endpoint ’/api/send’ acepta un parámetro ’media_path’ absoluto sin confinarlo a un directorio seguro. Combinados, estos problemas permiten a cualquier proceso local ejecutándose como el mismo usuario que el puente enviar mensajes de WhatsApp desde la cuenta emparejada sin autorización; al mismo llamador leer archivos arbitrarios legibles por el usuario (por ejemplo, claves privadas SSH, datos de sesión del navegador, código fuente, dotfiles) y exfiltrarlos como archivos adjuntos de documentos de WhatsApp; y/o a un atacante remoto desencadenar las mismas operaciones a través de la reasignación de DNS desde una página web que el usuario visita, ya que no se realiza validación del encabezado Host. En entornos MCP, ’llamador local’ se extiende más allá de los procesos que el usuario lanzó explícitamente - servidores MCP hermanos, extensiones de IDE y flujos activados por herramientas ejecutándose en la sesión del usuario pueden actuar como el llamador efectivo. Este problema está solucionado en whatsapp-mcp v0.2.1 y las imágenes Docker / artefactos de lanzamiento correspondientes. Los usuarios deben actualizar inmediatamente. La solución introduce autenticación con token de portador en la API HTTP del puente (configurada mediante variable de entorno, requerida en todas las solicitudes, validada con comparación de tiempo constante); validación de lista de permitidos del encabezado host para prevenir la reasignación de DNS; y confinamiento de ’media_path’ a un directorio configurado, con rechazo de rutas absolutas fuera de la raíz y secuencias de salto de ruta. Esto es un cambio disruptivo para los clientes de la API del puente. Para los usuarios que no pueden actualizar inmediatamente: Detenga el puente, o bloquee el acceso de bucle invertido al puerto 8080, cuando el puente no esté en uso activo; evite ejecutar el puente junto con servidores MCP no confiables, extensiones de navegador u otros procesos locales no confiables; evite navegar por sitios no confiables mientras el puente esté en ejecución (mitigación de reasignación de DNS); y/o ejecute el puente bajo una cuenta de usuario dedicada o en un sandbox/contenedor sin acceso a archivos sensibles. -
Initial Analysis by [email protected]
Aug. 18, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Added CPE Configuration OR *cpe:2.3:a:verygoodplugins:whatsapp_mcp_server:*:*:*:*:*:*:*:* versions up to (excluding) 0.2.1 Added Reference Type GitHub, Inc.: https://github.com/verygoodplugins/whatsapp-mcp/blob/main/SECURITY.md Types: Issue Tracking Added Reference Type GitHub, Inc.: https://github.com/verygoodplugins/whatsapp-mcp/releases/tag/v0.2.1 Types: Product, Release Notes Added Reference Type GitHub, Inc.: https://github.com/verygoodplugins/whatsapp-mcp/security/advisories/GHSA-7jj9-4qqq-4xc4 Types: Mitigation, Patch, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 20, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-46555', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-20T17:35:08.494886Z'} -
New CVE Received by [email protected]
Jul. 20, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'verygoodplugins', 'product': 'whatsapp-mcp', 'versions': [{'status': 'affected', 'version': '< 0.2.1'}]}] Added Description WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files. Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Added CWE CWE-22 Added CWE CWE-346 Added CWE CWE-306 Added Reference https://github.com/verygoodplugins/whatsapp-mcp/blob/main/SECURITY.md Added Reference https://github.com/verygoodplugins/whatsapp-mcp/releases/tag/v0.2.1 Added Reference https://github.com/verygoodplugins/whatsapp-mcp/security/advisories/GHSA-7jj9-4qqq-4xc4