EUVD-2026-42611
GHSA-rx6v-r244-h59w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF requiring authenticated low-privilege access; confidentiality-only impact from server-side request forgery, no direct integrity or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in aerostackdev aerostack-mcp up to 6315dfde7df0a15aaf743f88d91347115e09ba23. Affected by this issue is the function upload_media of the component mcp-whatsapp. Such manipulation of the argument media_url leads to server-side request forgery. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in aerostackdev aerostack-mcp's mcp-whatsapp component allows authenticated remote attackers to manipulate the media_url argument of the upload_media function, causing the server to issue arbitrary outbound HTTP requests on the attacker's behalf. Affected installations span all commits up to 6315dfde7df0a15aaf743f88d91347115e09ba23 with no vendor patch available and no maintainer response to the disclosure. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
aerostack-mcp is a Model Context Protocol (MCP) server implementation by aerostackdev, exposing AI-agent tooling capabilities including WhatsApp media handling via the mcp-whatsapp component. CWE-918 (Server-Side Request Forgery) describes the root cause: user-controlled input is used to construct a URL that the server then fetches without adequate validation or allowlisting. In this case, the media_url argument passed to upload_media is forwarded to an outbound HTTP client without domain or IP-range restrictions. This allows supply of internal addresses such as RFC 1918 ranges, loopback (127.0.0.1), or cloud instance metadata endpoints (169.254.169.254). The CPE identifier cpe:2.3:a:aerostackdev:aerostack-mcp:*:*:*:*:*:*:*:* confirms no version boundary - the entire product history is affected, consistent with the rolling-release distribution model.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the coordinated disclosure reported at https://github.com/aerostackdev/aerostack-mcp/issues/3. As the primary compensating control, operators should implement a strict URL allowlist within the upload_media function that permits only explicitly approved external domains, rejecting all requests targeting RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses, and cloud metadata endpoints (169.254.169.254 for AWS, fd00:ec2::254 for IPv6). Deploying an egress firewall on the host running aerostack-mcp to block outbound connections to internal network ranges eliminates the internal-SSRF escalation path, though it may disrupt legitimate media fetch functionality if not carefully scoped. In AWS environments, enforcing IMDSv2 (requiring a PUT-based session token) prevents classic metadata credential extraction via SSRF. Monitor the GitHub issue for any patch release.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today