What is the CVSS score of CVE-2026-46555?

CVE-2026-46555 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of WhatsApp MCP Server are affected by CVE-2026-46555?

WhatsApp MCP Server (whatsapp-mcp) versions prior to v0.2.1 contain an unauthenticated API vulnerability that enables attackers to send unauthorized WhatsApp messages and exfiltrate sensitive files…. A patch is available.

How to fix or mitigate CVE-2026-46555?

Within 24 hours, conduct a complete inventory of systems and applications using whatsapp-mcp and identify any deployments running versions prior to v0.2.1. Within 7 days, upgrade all affected instances to v0.2.1 or later, test the patched version in staging to ensure compatibility with your IDE and MCP configurations, and deploy updates to all production systems. Within 30 days, perform a forensic audit of sensitive files including SSH keys, API credentials, and browser session data for signs of unauthorized access or exfiltration; rotate all potentially compromised credentials; and implement logging to detect suspicious WhatsApp activity patterns originating from your development infrastructure.

WhatsApp MCP Server CVE-2026-46555

EUVD-2026-46037 HIGH

Path Traversal (CWE-22)

2026-07-20 GitHub_M

Docker Path Traversal Whatsapp Mcp Verygoodplugins

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

HIGH

qualitative

NVD

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Same-user local process access required (AV:L, PR:L); no added complexity on loopback once running; high C and I for arbitrary file exfiltration and WhatsApp message impersonation; no availability impact described.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 18, 2026 - 19:19 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 18, 2026 - 19:07 vuln.today

cvss_changed

CVSS changed

Aug 18, 2026 - 19:07 NVD

7.7 (HIGH) 7.1 (HIGH)

Patch available

Jul 20, 2026 - 18:18 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 18:09 vuln.today

Analysis Generated

Jul 20, 2026 - 18:09 vuln.today

CVE Published

Jul 20, 2026 - 17:06 cve.org

HIGH 7.7

DescriptionNVD

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts an absolute media_path parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched - sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of media_path to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files.

AnalysisAI

Unauthenticated loopback API access and path traversal in WhatsApp MCP Server (whatsapp-mcp) prior to v0.2.1 allow any same-user local process - including sibling MCP servers and IDE extensions - to send WhatsApp messages from the paired account and exfiltrate arbitrary user-readable files (SSH private keys, browser session data, dotfiles) as WhatsApp document attachments. The whatsapp-bridge HTTP service on 127.0.0.1:8080 requires no authentication and validates no Host header, enabling a DNS rebinding attack whereby a malicious webpage visited by the user can trigger identical file exfiltration remotely without any credentials. No public exploit identified at time of analysis; vendor-released patch v0.2.1 is available.

Technical ContextAI

The whatsapp-bridge component of verygoodplugins/whatsapp-mcp (CPE: cpe:2.3:a:verygoodplugins:whatsapp-mcp:*:*:*:*:*:*:*:*) is a Go-based HTTP service acting as a local proxy between the Model Context Protocol (MCP) server layer and the WhatsApp messaging backend. It listens on 127.0.0.1:8080 and exposes REST endpoints including /api/send, which accepts a media_path parameter designating the file to attach to outbound messages. The primary root cause is CWE-22 (Path Traversal): media_path is accepted without confinement to a safe directory, so callers can supply any absolute path readable by the bridge process user, including ~/.ssh/id_rsa or browser profile stores. This is compounded by two missing security controls: bearer-token authentication (absent on all /api/* routes) and Host header validation. The absent Host validation enables DNS rebinding - an attacker's domain is re-resolved to 127.0.0.1 by the victim's browser after initial resolution, causing the browser to issue same-origin fetch() calls to the loopback service. In MCP deployment contexts the implicit 'loopback equals trusted' assumption fails because multiple agents, IDE extensions, and AI-tool-triggered subprocess flows share the same loopback interface under the same OS user account, expanding the effective local caller population far beyond what the user intentionally launched.

RemediationAI

Upgrade to whatsapp-mcp v0.2.1 (released 2026-05-14), available at https://github.com/verygoodplugins/whatsapp-mcp/releases/tag/v0.2.1 and corresponding Docker images. Note this is a breaking change: existing installs must restart both the bridge and MCP server components and configure the WHATSAPP_BRIDGE_TOKEN environment variable, or allow the MCP server to auto-read a generated token from whatsapp-bridge/store/.bridge-token; outbound media files must reside under WHATSAPP_MEDIA_ROOTS or the default outbox directory, and absolute paths outside this root are now rejected. For users unable to immediately upgrade: stop the bridge process or block loopback port 8080 (via host firewall or process kill) when the bridge is not actively in use - this eliminates both the local and DNS rebinding attack surfaces; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes sharing the same OS user; avoid browsing untrusted websites while the bridge is running, which mitigates DNS rebinding; and consider running the bridge under a dedicated OS user account or inside a container or sandbox with no access to sensitive user files such as ~/.ssh or browser profile directories. These compensating controls reduce but do not fully eliminate exposure - upgrading remains the only authoritative fix, as detailed in SECURITY.md at https://github.com/verygoodplugins/whatsapp-mcp/blob/main/SECURITY.md.