CVE-2026-15189

Name of the Vulnerable Software and Affected Versions aerostackdev aerostack-mcp versions up to 6315dfde7df0a15aaf743f88d91347115e09ba23

Description A remote attacker can trigger server-side request forgery (SSRF)—a flaw that allows a server to be coerced into making unauthorized requests to internal or external resources—by manipulating the media url argument within the upload media() function of the mcp-whatsapp component.

Recommendations As a temporary workaround, restrict the use of the upload media() function in the mcp-whatsapp component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.