CVE-2026-15189: SSRF in aerostack-mcp WhatsApp Media Upload – Patch Guidance

Technical summary

The upload_media function in the mcp-whatsapp component fails to properly validate or restrict the media_url input parameter before using it in server-side HTTP operations. This classic SSRF flaw (CWE-918) allows an authenticated user to supply arbitrary URLs, causing the server to fetch content from attacker-controlled destinations or internal network addresses (10.x.x.x, 169.254.x.x, localhost, etc.). The vulnerability requires valid authentication but no elevated privileges, and can be exploited over the network without user interaction. The rolling release model complicates traditional version tracking, but the commit hash marks the known-vulnerable state.

Business impact

Organizations using aerostack-mcp for WhatsApp integration face risk of internal network reconnaissance, exfiltration of sensitive data served by internal services (databases, caches, metadata endpoints), and potential pivot points for lateral attacks. The requirement for authentication limits exposure to insider threats or compromised user accounts. However, if this component is exposed in a multi-tenant or loosely-controlled environment, the impact could escalate. Incident response teams should assess whether internal service endpoints are accessible via the application and what data they expose.

Affected systems

aerostack-mcp (aerostackdev/aerostack-mcp) up to and including commit 6315dfde7df0a15aaf743f88d91347115e09ba23. The project operates on a rolling release basis without traditional version numbering, so all deployments using commits at or before the vulnerable hash are affected. Organizations must verify their exact deployment commit hash to confirm exposure. No specific vendor product versions are formally listed; affected parties should check their own aerostack-mcp installation metadata.

Exploitability

Exploitability is moderate. The attack requires valid authentication (PR:L in the CVSS vector), which limits the threat to insiders or accounts obtained through credential compromise. Once authenticated, no additional user interaction or system complexity is needed—the attacker simply calls the upload_media endpoint with a malicious media_url. Network access is required but unrestricted (AV:N). The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, though the lack of vendor response increases the risk window.

Remediation

The aerostack-mcp project should implement strict URL validation and allowlisting on the media_url parameter, such as: restricting to https:// protocol, validating against a whitelist of approved domains, blocking private IP ranges (RFC 1918, link-local, loopback), and using a timeout on server-initiated requests. Organizations should update to the latest rolling release commit after the vendor publishes a fix. Pending a vendor patch, implement network-level controls to restrict outbound HTTP(S) traffic from the aerostack-mcp service to only approved external domains and block internal service endpoints.

Patch guidance

Aerostack-mcp does not provide traditional version numbers. To remediate, pull the latest commit from the main branch after the vendor publishes a security fix. Monitor the project's issue tracker and commit history for a patch addressing CWE-918 in upload_media. Verify the fix includes URL validation that blocks private IP ranges and enforces a whitelist of trusted domains. Test the updated code in a staging environment before deploying to production. Given the early-stage nature of this disclosure and lack of vendor response, consider contacting the maintainers directly or checking if a security advisory has been published.

Detection guidance

Monitor logs for calls to the upload_media endpoint with suspicious media_url parameters, including attempts to access private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost addresses, AWS metadata endpoints (169.254.169.254), or internal hostnames. Inspect outbound HTTP(S) traffic from the aerostack-mcp service for unexpected destinations. Web application firewalls can be configured to block requests with URL-like media_url values pointing to internal networks. Correlation of upload_media calls with unusual egress traffic patterns may indicate exploitation attempts.

Why prioritize this

This vulnerability merits prompt remediation for organizations actively using aerostack-mcp. While the CVSS score is MEDIUM (6.3) and authentication is required, SSRF vulnerabilities are frequently chained with other attacks and can bypass network segmentation. The vendor's lack of response compounds the risk—there is no official timeline for a patch. If your infrastructure exposes sensitive internal services (configuration servers, metadata endpoints, internal databases) on the network where aerostack-mcp runs, prioritize this fix. For air-gapped or restricted environments with tight network controls, risk is lower but not eliminated.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires low privileges (PR:L) but causes low impact to confidentiality, integrity, and availability (C:L/I:L/A:L). The score appropriately captures the authentication barrier and limited direct impact on the application itself. However, the real-world risk is higher if internal services are accessible from the application's network context—SSRF can become a critical vector for privilege escalation or data theft in multi-service architectures. The lack of vendor response and rolling-release uncertainty also increase operational risk.

Frequently asked questions