CVE-2026-46555

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files.

• CWE-22
• CWE-306
• CWE-346

• https://github.com/verygoodplugins/whatsapp-mcp/blob/main/SECURITY.md
• https://github.com/verygoodplugins/whatsapp-mcp/releases/tag/v0.2.1
• https://github.com/verygoodplugins/whatsapp-mcp/security/advisories/GHSA-7jj9-4qqq-4xc4

Published

Jul 20, 2026

Last Modified

Jul 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4655The Element Pack Addons for Elementor plugin for WordPress i…6.4
• CVE-2026-46550NocoDB is software for building databases as spreadsheets. P…5.4
• CVE-2026-46551NocoDB is software for building databases as spreadsheets. P…6.5
• CVE-2026-46552NocoDB is software for building databases as spreadsheets. P…5.8
• CVE-2026-46553NocoDB is software for building databases as spreadsheets. P…2.1
• CVE-2026-46554NocoDB is software for building databases as spreadsheets. P…2.3
• CVE-2026-46556FlaskBB is a Forum Software written in Python using the micr…6.5
• CVE-2026-46557ImageMagick is free and open-source software used for editin…6.2
• CVE-2026-46558Plane is an open-source project management tool. Prior to ve…8.3
• CVE-2026-46559ImageMagick is free and open-source software used for editin…4
• CVE-2026-4656Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-46561pyLoad is a free and open-source download manager written in…5