CVE-2026-46555
Received Received - Intake

Authentication Bypass in WhatsApp MCP Server

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-46555
EUVD
EUVD-2026-46037

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
verygoodplugins whatsapp-mcp 0.2.1
verygoodplugins whatsapp-mcp to 0.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46555 is a vulnerability in the WhatsApp MCP Server prior to version 0.2.1. The bridge API listens on 127.0.0.1:8080 without authentication or Host header validation. The /api/send endpoint accepts an absolute media_path parameter without directory confinement. This allows local processes to send unauthorized WhatsApp messages, read arbitrary user files, or exfiltrate them as attachments. Remote attackers could exploit this via DNS rebinding due to missing Host header validation.

Detection Guidance

Check if the whatsapp-bridge HTTP API is listening on 127.0.0.1:8080 without authentication. Use commands like 'netstat -tulnp | grep 8080' or 'ss -tulnp | grep 8080' to verify. Inspect network traffic for unauthorized connections to this port.

Impact Analysis

An attacker could send WhatsApp messages from your account without permission, access sensitive files like SSH keys or browser data, or trick you into visiting a malicious site to trigger these actions via DNS rebinding. Local processes or sibling MCP servers could also abuse the bridge to read or exfiltrate files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as SSH keys, browser session data, or source code, which may violate GDPR's data protection principles or HIPAA's safeguards for protected health information. The lack of authentication and path traversal risks enable data exfiltration, potentially exposing personal or confidential data.

Mitigation Strategies

Upgrade to whatsapp-mcp v0.2.1 or later to enable bearer token authentication and Host header validation. Alternatively, stop the bridge or block loopback access to port 8080 when not in use. Avoid running the bridge alongside untrusted processes or browsing untrusted sites while it is active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart