--- cve: "CVE-2026-46555" severity: "HIGH" cvss: 7.7 epss: "0.2%" vendor: "verygoodplugins" kev: false exploited: false published: "2026-07-20 17:17:09" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-24T07:11:37+02:00" --- # CVE-2026-46555 > 7.7 HIGH · 🧪 PoC ## Beschreibung WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these issues allow any local process running as the same user as the bridge to send WhatsApp messages from the paired account without authorization; the same caller to read arbitrary files readable by the user (e.g. SSH private keys, browser session data, source code, dotfiles) and exfiltrate them as WhatsApp document attachments; and/or a remote attacker to trigger the same operations via DNS rebinding from a webpage the user visits, since no Host header validation is performed. In MCP environments, "local caller" extends beyond processes the user explicitly launched — sibling MCP servers, IDE extensions, and tool-triggered flows running in the user's session can act as the effective caller. This issue is fixed in whatsapp-mcp v0.2.1 and corresponding Docker images / release artifacts. Users should upgrade immediately. The fix introduces bearer token authentication on the bridge HTTP API (configured via environment variable, required on all requests, validated with constant-time comparison); host header allow-list validation to prevent DNS rebinding; and confinement of `media_path` to a configured directory, with rejection of absolute paths outside the root and path traversal sequences. This is a breaking change for clients of the bridge API. For users who cannot immediately upgrade: Stop the bridge, or block loopback access to port 8080, when the bridge is not actively in use; avoid running the bridge alongside untrusted MCP servers, browser extensions, or other untrusted local processes; avoid browsing untrusted sites while the bridge is running (DNS rebinding mitigation); and/or run the bridge under a dedicated user account or in a sandbox/container with no access to sensitive files. ## CVSS-Vektor ``` CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Lokal | good | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Hoch | bad | | I Integrität | Hoch | bad | | A Verfügbarkeit | Keine | good | ## Patch verfügbar (OSV) - 6bb5359e8ee68e3285745c8bb86d6c9be88ae2b1 (Commit) ## Referenzen - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-46555) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_