CVE-2026-46555: WhatsApp MCP Server bridge API unauthenticated local and DNS rebinding access

Summary

WhatsApp MCP Server, prior to version 0.2.1, exposes its `whatsapp-bridge` HTTP API on `127.0.0.1:8080` without authentication or Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` without confinement to a safe directory. A local process running as the same user, or a remote attacker via DNS rebinding from a visited webpage, can send messages from the paired account, read arbitrary user-readable files such as SSH keys, and exfiltrate them as WhatsApp attachments.

Mitigation

Fixed in whatsapp-mcp v0.2.1 and corresponding Docker images and release artifacts, which add bearer token authentication, host header allow-list validation, and confinement of `media_path` to a configured directory. This is a breaking change for bridge API clients. Users who cannot upgrade immediately should stop the bridge or block loopback access to port 8080 when unused, avoid running it alongside untrusted MCP servers or local processes, avoid browsing untrusted sites while it runs, and/or run it under a dedicated user account or in a sandbox/container without access to sensitive files.

Topics

• Model Context Protocol

Related items

• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database