Executive brief
A security vulnerability exists in the WhatsApp component of aerostack-mcp, a toolset used to connect AI models to various external services. An attacker can trick the server into making unauthorized network requests to internal or external systems. This could lead to the exposure of sensitive internal data or allow the attacker to probe private network infrastructure that is otherwise inaccessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the mcp-whatsapp component of aerostack-mcp. The root cause is located in the upload_media function, where the media_url argument is passed directly to a fetch() call without validation of the destination host, IP address, or protocol. A remote attacker with the ability to call this tool can provide a malicious URL (such as a loopback address or internal metadata service) to trigger outbound requests from the server's network context. This can be used to scan internal ports, access cloud metadata services, or bypass network-level access controls. As of the advisory date, the project operates on a rolling release basis and has not yet responded to the issue report.
Affected products
- aerostackdev aerostack-mcp up to 6315dfde7df0a15aaf743f88d91347115e09ba23
Timeline
- 2026-06-08: disclosed: Issue reported on GitHub repository
- 2026-07-09: advisory: CVE published by VulDB/NVD