CVE-2026-6979 Overview
CVE-2026-6979 is a Server-Side Request Forgery (SSRF) vulnerability in devlikeapro WAHA versions up to 2026.3.4. The flaw exists in an unknown function within the src/api/media.controller.ts file, part of the API Request Handler component. Attackers can manipulate the affected function to issue arbitrary outbound requests from the server context. The attack vector is network-based and requires low privileges. The exploit has been published, and the vendor did not respond to early disclosure attempts. The weakness is classified under CWE-918.
Critical Impact
Authenticated remote attackers can coerce the WAHA server to send crafted HTTP requests to internal or external resources, exposing internal services and metadata endpoints.
Affected Products
- devlikeapro WAHA versions up to and including 2026.3.4
- Component: API Request Handler (src/api/media.controller.ts)
- Deployments exposing the WAHA media API to untrusted clients
Discovery Timeline
- 2026-04-25 - CVE CVE-2026-6979 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-6979
Vulnerability Analysis
The vulnerability resides in the media controller of devlikeapro WAHA, a WhatsApp HTTP API service. The src/api/media.controller.ts file processes media-related API requests, and an unspecified function within it fetches remote resources based on user-controlled input. Because the application does not validate the destination URL, an authenticated caller can supply arbitrary targets. The server then issues HTTP requests to those targets on behalf of the attacker. This pattern matches Server-Side Request Forgery as catalogued under CWE-918. The EPSS probability is 0.038%, but a public proof-of-concept exists, which raises operational risk for exposed instances.
Root Cause
The root cause is missing validation of user-supplied URLs before the server performs an outbound request. The media controller accepts a destination identifier and forwards a request without enforcing an allowlist of hosts, blocking private IP ranges, or restricting URL schemes. Authenticated low-privilege users can therefore reach internal services, loopback addresses, and cloud metadata endpoints reachable from the server.
Attack Vector
The attack is remote and requires low privileges. An attacker authenticated to the WAHA API submits a crafted request to the affected media endpoint with a URL pointing at an internal resource. The server resolves and fetches the target, returning data or side-effects to the attacker. Typical SSRF targets include http://127.0.0.1, internal RFC1918 subnets, container orchestration APIs, and instance metadata services such as http://169.254.169.254/. Technical discussion is available in the GitHub Issue Discussion and the VulDB #359522 entry.
No verified exploit code is reproduced here. Review the published proof-of-concept in the referenced advisories for technical details.
Detection Methods for CVE-2026-6979
Indicators of Compromise
- Outbound HTTP requests from the WAHA host targeting 127.0.0.1, RFC1918 ranges, or 169.254.169.254
- Unexpected access to cloud instance metadata endpoints originating from the WAHA process
- Anomalous response sizes or unusual MIME types returned through the WAHA media API
- Authenticated API requests to the media controller containing URL parameters pointing to internal hostnames
Detection Strategies
- Inspect WAHA application logs for media controller requests where supplied URLs resolve to private or link-local IP addresses
- Correlate API calls with the host's egress network telemetry to flag outbound traffic that does not match expected WhatsApp service endpoints
- Apply web application firewall rules that match SSRF payload patterns in request bodies and query parameters
Monitoring Recommendations
- Forward WAHA container logs and host network flow data to a centralized analytics platform for correlation
- Alert on any successful HTTP responses from the WAHA process to internal-only addresses
- Track authentication events that precede media API calls to attribute SSRF attempts to specific user accounts
How to Mitigate CVE-2026-6979
Immediate Actions Required
- Restrict network egress from the WAHA host to only the destinations required for WhatsApp connectivity
- Place the WAHA API behind an authenticated reverse proxy and limit access to trusted clients
- Revoke and rotate any API credentials that may have been used to probe the affected endpoint
- Block requests to cloud metadata addresses such as 169.254.169.254 at the host or network level
Patch Information
No vendor patch is referenced in the available data. The vendor did not respond to the disclosure, and no fixed version has been published as of the last NVD update on 2026-04-29. Monitor the devlikeapro WAHA project for future releases addressing the media controller.
Workarounds
- Deploy WAHA inside a network namespace or container with strict egress filtering that denies private address ranges
- Front the WAHA media endpoint with a proxy that validates URLs against an allowlist of approved hosts and schemes
- Disable or restrict access to the media API for accounts that do not require remote media fetching
- Apply host-based firewall rules to block outbound traffic to loopback and link-local addresses from the WAHA process
# Example iptables egress filtering for the WAHA container user (uid 1000)
iptables -A OUTPUT -m owner --uid-owner 1000 -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 1000 -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
