CVE-2026-91997mediumCWE-697

CVE-2026-91997: medium-severity vulnerability in evolution-foundation evolution-api

evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

Published · Updated

Follow this CVE+ Monitor evolution-api

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.4%
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
evolution-foundation · evolution-api
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.