CVE-2026-46555: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in verygoodplugins whatsapp-mcp
WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files.
AI Analysis
Technical Summary
The whatsapp-mcp server prior to version 0.2.1 exposes an unauthenticated HTTP API on localhost (127.0.0.1:8080) that lacks Host header validation and accepts an absolute media_path parameter without directory confinement. This combination enables local attackers running as the same user to send WhatsApp messages from the paired account without authorization, read arbitrary files accessible to that user (including sensitive files like SSH keys and browser data), and exfiltrate them as WhatsApp document attachments. Remote attackers can also exploit DNS rebinding attacks to perform these actions via a webpage due to missing Host header validation. The vulnerability is addressed in version 0.2.1 by introducing bearer token authentication, Host header allow-list validation to prevent DNS rebinding, and restricting media_path to a configured safe directory. These changes break compatibility with existing clients of the bridge API. For users unable to upgrade immediately, recommended mitigations include stopping the bridge when not in use, blocking loopback access to port 8080, avoiding running untrusted local processes alongside the bridge, avoiding browsing untrusted sites while the bridge is active, or running the bridge under a dedicated user or sandbox.
Potential Impact
An attacker with local access as the same user running the whatsapp-bridge can send WhatsApp messages without authorization and read arbitrary files accessible to that user, potentially exposing sensitive information such as SSH private keys, browser session data, source code, and dotfiles. Remote attackers can exploit DNS rebinding to achieve similar unauthorized actions via a webpage. This can lead to confidentiality breaches and unauthorized message sending. The vulnerability does not impact availability and requires local or DNS rebinding attack vectors.
Mitigation Recommendations
A fix is available in whatsapp-mcp version 0.2.1, which introduces bearer token authentication on the bridge HTTP API, Host header allow-list validation to prevent DNS rebinding, and confines media_path to a configured safe directory. Users should upgrade immediately to this version. For those who cannot upgrade immediately, recommended mitigations include stopping the bridge or blocking loopback access to port 8080 when not in use, avoiding running untrusted local processes alongside the bridge, avoiding browsing untrusted websites while the bridge is running, and running the bridge under a dedicated user account or in a sandbox/container with restricted file access.
CVE-2026-46555: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in verygoodplugins whatsapp-mcp
Description
WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files.
CVSS v3.1
Score 7.7high
Affected software
pkg:github/verygoodplugins/whatsapp-mcpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The whatsapp-mcp server prior to version 0.2.1 exposes an unauthenticated HTTP API on localhost (127.0.0.1:8080) that lacks Host header validation and accepts an absolute media_path parameter without directory confinement. This combination enables local attackers running as the same user to send WhatsApp messages from the paired account without authorization, read arbitrary files accessible to that user (including sensitive files like SSH keys and browser data), and exfiltrate them as WhatsApp document attachments. Remote attackers can also exploit DNS rebinding attacks to perform these actions via a webpage due to missing Host header validation. The vulnerability is addressed in version 0.2.1 by introducing bearer token authentication, Host header allow-list validation to prevent DNS rebinding, and restricting media_path to a configured safe directory. These changes break compatibility with existing clients of the bridge API. For users unable to upgrade immediately, recommended mitigations include stopping the bridge when not in use, blocking loopback access to port 8080, avoiding running untrusted local processes alongside the bridge, avoiding browsing untrusted sites while the bridge is active, or running the bridge under a dedicated user or sandbox.
Potential Impact
An attacker with local access as the same user running the whatsapp-bridge can send WhatsApp messages without authorization and read arbitrary files accessible to that user, potentially exposing sensitive information such as SSH private keys, browser session data, source code, and dotfiles. Remote attackers can exploit DNS rebinding to achieve similar unauthorized actions via a webpage. This can lead to confidentiality breaches and unauthorized message sending. The vulnerability does not impact availability and requires local or DNS rebinding attack vectors.
Mitigation Recommendations
A fix is available in whatsapp-mcp version 0.2.1, which introduces bearer token authentication on the bridge HTTP API, Host header allow-list validation to prevent DNS rebinding, and confines media_path to a configured safe directory. Users should upgrade immediately to this version. For those who cannot upgrade immediately, recommended mitigations include stopping the bridge or blocking loopback access to port 8080 when not in use, avoiding running untrusted local processes alongside the bridge, avoiding browsing untrusted websites while the bridge is running, and running the bridge under a dedicated user account or in a sandbox/container with restricted file access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-14T20:42:31.369Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e56f42a4a8d5989689f9a
Added to database: 07/20/2026, 17:12:20 UTC
Last enriched: 07/20/2026, 17:26:57 UTC
Last updated: 07/21/2026, 07:32:41 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.