AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

CVE-2026-46555: WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes

highvulnerabilityLLM-Specific

security

Source: NVD/CVE DatabaseJuly 20, 2026CVE-2026-46555

Summary

WhatsApp MCP Server before version 0.2.1 has a critical security flaw where its HTTP API runs without authentication or Host header validation (a check that prevents attackers from impersonating the service), allowing local processes or remote attackers to send WhatsApp messages, steal sensitive files like SSH keys, and exfiltrate data without permission. This vulnerability is especially dangerous in MCP environments (where Claude can use multiple tools together) because sibling servers and IDE extensions running in the user's session can exploit it.

Solution / Mitigation

Upgrade to whatsapp-mcp v0.2.1 or later, which fixes the issue by adding bearer token authentication (a secret password required for all API requests), Host header allow-list validation to block DNS rebinding attacks, and restricting file access to a safe directory while rejecting absolute paths and directory traversal attempts. For users unable to upgrade immediately, the source recommends: stop the bridge or block loopback port 8080 access when not in use; avoid running the bridge with untrusted MCP servers or extensions; avoid visiting untrusted websites while the bridge runs; and/or run the bridge as a dedicated user or in a sandbox (an isolated container) with no access to sensitive files.