Whatsapp Mcp ServerApplication · Verygoodplugins

CVE-2026-46555

HIGH · 7.1 CVSS v3.1 Developing Published 2026-07-20

Fix available

A fix is available. Upgrade to 0.2.1 or later.

See remediation →

73/100

Remediation priority · Elevated

Zero-click Patch available 4 weeks old

Official description

NVD · unedited

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files.

Technical summary

dbcve analysis · low confidence

Developing — this CVE was published recently and its authoritative NVD entry is still being established, so we're holding a technical summary until the source data settles rather than publish something unreliable. Re-checking after 2026-08-04.

Affected products & versions

NVD · CPE data

Whatsapp Mcp ServerApplication

Affected:< 0.2.1

CVSS breakdown

From the vector

Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Remediation

dbcve · scoped

Upgrade available Upgrade to 0.2.1 or later

Fixed in 0.2.1

Vendor patch github.com →

Recommended fix High confidence

whatsapp-mcp v0.2.1

Upgrade to whatsapp-mcp v0.2.1 or later
Configure bearer token authentication via the WHATSAPP_BRIDGE_TOKEN environment variable (or as documented for v0.2.1)
Update all API clients to include the bearer token in the Authorization header for all requests
Verify the fix by attempting a path traversal request (e.g., /api/send with media_path=/etc/passwd) and confirm it is rejected
If using Docker, pull the updated Docker image for v0.2.1 or later
After upgrade, test that: (1) unauthenticated requests are rejected, (2) absolute paths outside the configured media root are rejected, (3) path traversal sequences (..) in media_path are rejected

Caveat This is a breaking change: the bridge API now requires bearer token authentication on all requests; clients must be updated to include the Authorization header

Generated from the published advisory — verify against the referenced sources before acting.

We can perform the upgrade in your staging environment and verify nothing breaks — typical engagement from $1,950. Get the upgrade done

Scan for this in your stack

Free · runs locally

dbcve dependency scanner

Check whether your project pulls in CVE-2026-46555 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References

Primary sources

github.comPatch / commit
github.comMitigationPatchVendor Advisory
github.comProductRelease Notes
github.comIssue Tracking
nvd.nist.govNVD record

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-46555 in production — separate from our analysis above.

Notes0 Guidelines

Know something about CVE-2026-46555?

The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.

The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here

Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data

At a glance

A fix existsUpgrade to 0.2.1 or later

Severity 7.1 High

Exploit likelihood EPSS, next 30 days 0.2%

Affects: Whatsapp Mcp Server

Remediation

Need this fixed?

Get a fix

Estimated effortfrom ~11 hrs

ComplexityModerate

Typical engagementfrom $1,950

What a fix involves

We scope it with you and confirm a fixed quote
A specialist builds a reviewed fix
You deploy it to staging first
Optional re-test once it’s live

We specialise in CVE remediation. Send your environment and we’ll scope CVE-2026-46555 and return a fixed quote.

You’ll deal with our team directly and deploy the reviewed fix to staging first — never straight to production.

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

Scan for this in your stack

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Practitioner notes

No notes yet

Official description

Technical summary

Affected products & versions

CVSS breakdown

Remediation

References