Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91997evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

Medium 5.3

In plain English

A medium-severity security flaw in evolution-api from evolution-foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 60.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

Affected products (as reported)

Vendor	Product	Versions
evolution-foundation	evolution-api	0 – through 2.3.7

Weakness: CWE-697 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Researcher write-up third-party-advisory, exploit
metricsIPWhitelist middleware at 2.3.7 technical-description
https://github.com/evolution-foundation/evolution-api product
VulnCheck Advisory: evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass third-party-advisory