CVE-2026-91997 — evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /m…
Published: 2026-09-15 · CVSS: 6.9 · CVSS 4.0
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7