devlikeapro WAHA CVE-2026-6979

Authentication is required: an attacker must possess valid WAHA credentials or successfully compromise a legitimate user account to trigger the media API endpoint. The media.controller.ts function must be exposed and callable via the REST API (standard configuration). The server must have network egress to reach the target internal or external resource being probed. The vulnerability is not present in default unauthenticated configurations, as it requires passing the PR:L authentication gate. Exploitation is limited to targets reachable from the vulnerable server's network interface and does not increase scope beyond the compromised WAHA instance itself (S:X indicates scope not expanded).

The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation requiring authenticated login but with low attack complexity. The score of 5.3 reflects moderate impact: low confidentiality, integrity, and availability impact to the vulnerable component itself, with no scope expansion. However, SSRF vulnerabilities often carry greater real-world risk than CVSS suggests-the E:P (Proof-of-Concept Exploitable) indicator confirms publicly available exploit code, and the lack of vendor response increases concern. The authentication requirement (PR:L) is a significant limiting factor, restricting the attack surface to users with valid WAHA accounts or those who can compromise such credentials. The actual risk depends on deployment context: in multi-tenant SaaS environments where users cannot authenticate, impact is lower; in self-hosted or internal deployments, the SSRF could pivot to internal infrastructure. The metadata impact (VI:L) suggests the SSRF is not network-reaching (no scope increase), limiting it to direct server-side effects rather than cascading breaches. Risk is elevated by unresponsive vendor behavior, indicating patches may not be forthcoming quickly.

An authenticated WAHA user crafts a malicious API request to the media endpoint, supplying a forged URL pointing to an internal service (e.g., http://127.0.0.1:6379/info to probe Redis, or http://169.254.169.254/latest/meta-data/ for cloud credentials). The vulnerable media.controller.ts processes this request without URL validation and initiates an outbound connection from the server itself. The attacker receives the server's response, revealing internal topology, credentials, or service configuration details that can enable further lateral movement or privilege escalation.