CVE-2026-91997: evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
evolution-apito a version that resolves this vulnerability.Fixed in 2.3.7 - Compensating control
Ensure the /metrics endpoint is not accessible without authentication (the metricsIPWhitelist middleware in evolution-api through 2.3.7 always evaluates to false, allowing unauthenticated access).
Event History
Frequently Asked Questions
Who can access the exposed metrics endpoint?
Any unauthenticated remote attacker who can reach the /metrics endpoint can bypass the intended IP whitelist restriction.
What information could an attacker obtain?
The metrics may disclose the server version, database client name, configured server URL, and WhatsApp instance details.
Are deployments using an IP whitelist for metrics protected?
No. The metricsIPWhitelist middleware uses an incorrect array comparison that always evaluates to false, so the IP allowlist does not restrict access.