CVE-2026-15189

mediumCVSS 6.3covered by 1 sourcefirst seen 2026-07-09

A security vulnerability has been detected in aerostackdev aerostack-mcp up to 6315dfde7df0a15aaf743f88d91347115e09ba23. Affected by this issue is the function upload_media of the component mcp-whatsapp. Such manipulation of the argument media_url leads to server-side request forgery. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

⚡ Watch CVE-2026-15189

Get an email if CVE-2026-15189 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-15189: A security vulnerability has been detected in aerostackdev aerostack-mcp up to 6315dfde7df0a15…nvd · 2026-07-09

External references

NVD record for CVE-2026-15189

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-15189 status](https://www.csirts.com/badge/CVE-2026-15189)](https://www.csirts.com/cve/CVE-2026-15189)