Executive brief
The WhatsApp MCP Server allows AI tools like Claude to read and send WhatsApp messages. A security flaw in the bridge component allows other software on the same computer, or malicious websites visited by the user, to send unauthorized messages and steal sensitive files (such as SSH keys or browser data) by sending them as message attachments. This could lead to significant data theft and unauthorized communication from the user's account.
Technical details
The `whatsapp-bridge` component in WhatsApp MCP Server prior to version 0.2.1 suffers from three combined vulnerabilities: missing authentication on its HTTP API (listening on 127.0.0.1:8080), lack of Host header validation, and an unconstrained `media_path` parameter in the `/api/send` endpoint. A local attacker or a remote attacker (via DNS rebinding) can exploit these to send messages from the paired WhatsApp account. Furthermore, because the `media_path` accepts absolute paths without validation (CWE-22), an attacker can read any file accessible to the user running the bridge and exfiltrate it as a document attachment. The vulnerability is particularly impactful in Model Context Protocol (MCP) environments where sibling servers or IDE extensions can act as the caller. Version 0.2.1 fixes these issues by implementing bearer token authentication, Host header allow-listing, and strict directory confinement for media files.
Affected products
- verygoodplugins whatsapp-mcp < 0.2.1
Timeline
- 2026-05-14: patched: Version 0.2.1 released
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD