CVE-2026-91997
Received Received - Intake

Incorrect Array Comparison in Evolution-API Allows Unauthenticated Metrics Access

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91997
EUVD
EUVD-2026-78437

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
evolution_foundation evolution_api 2.3.7
evolution_foundation evolution_api to 2.3.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91997 affects Evolution API v2.3.7 due to a JavaScript type error in the metricsIPWhitelist middleware. The condition `if (allowedIPs.filter(ip => clientIPs.includes(ip)) === 0)` incorrectly compares an array to the number 0, always returning false. This bypasses IP whitelist restrictions, allowing unauthenticated access to the /metrics endpoint when PROMETHEUS_METRICS=true and METRICS_ALLOWED_IPS is set.

Detection Guidance

To detect this vulnerability, check if the /metrics endpoint is accessible without proper IP restrictions. Use curl to query the endpoint from a non-whitelisted IP: curl -v http://<server-address>/metrics. If the response returns metrics data with HTTP 200, the system is vulnerable.

Impact Analysis

Attackers can access sensitive metrics data including server version, database client name, server URL, and WhatsApp instance details. In multi-tenant environments, instance names may reveal company identifiers. The vulnerability allows full metrics exposure without authentication if METRICS_AUTH_REQUIRED is false or omitted.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data exposure) and HIPAA (sensitive health data exposure) by allowing unauthorized access to server and application metrics that may contain personal or sensitive information.

Mitigation Strategies

Immediately update to a patched version of Evolution API. If updating is not possible, enable MEtRICS_AUTH_REQUIRED=true in the environment configuration to enforce Basic Auth. Additionally, restrict network access to the /metrics endpoint via firewall rules until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart