CVE-2026-91997 in evolution-api
Summary
by MITRE • 09/15/2026
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in evolution-api versions through 2.3.7 represents a critical authentication bypass rooted in flawed logic within the application's middleware layer. Specifically, the issue resides in the metricsIPWhitelist middleware, which is designed to restrict access to sensitive monitoring endpoints based on client IP addresses. The core technical flaw involves an incorrect array comparison operation that consistently evaluates to false regardless of the input parameters or configuration state. In many programming languages and frameworks, comparing arrays using standard equality operators often results in reference comparisons rather than value-based comparisons, leading to unexpected logical outcomes. Because this condition always resolves to false, the middleware fails to enforce its intended security controls, effectively rendering the IP whitelist mechanism inert for any request targeting the protected resources.
This logic error directly impacts the availability and confidentiality of critical system metrics by allowing unauthenticated access to the /metrics endpoint. Under normal operational conditions, this endpoint should be restricted to authorized internal monitoring tools or administrators with specific whitelisted IP addresses. However, due to the bypass, external attackers can interact with this interface without providing any credentials or originating from an approved network segment. The exposure of these metrics reveals a significant amount of sensitive infrastructure intelligence, including the exact server version running on the backend, which aids in identifying known vulnerabilities associated with that specific release. Furthermore, disclosure of the database client name exposes details about the underlying data storage technology, while the configured server URL provides insight into the network topology and internal routing configurations.
The exposure of WhatsApp instance details constitutes a severe privacy and security risk beyond mere information leakage. These details can include identifiers for active sessions, connection states, or other metadata that could facilitate targeted attacks against specific users or organizations utilizing the platform. Attackers leveraging this access do not need to exploit complex injection flaws or buffer overflows; they simply require network connectivity to the exposed port to harvest valuable reconnaissance data. This aligns with common attack patterns where adversaries gather information about target systems before launching more sophisticated exploits, making this vulnerability a prime candidate for automated scanning and exploitation by threat actors seeking low-effort entry points into enterprise environments.
From a classification perspective, this flaw corresponds closely to CWE-209, which describes the generation of an error message that includes sensitive information, as well as CWE-798, involving the use of hard-coded credentials or incorrect access control logic. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates reconnaissance activities under techniques like T1592, where attackers gather victim host properties to understand the target environment better. The inability of the middleware to properly validate IP addresses also touches upon CWE-284, which covers improper access control failures that allow unauthorized actors to bypass security restrictions intended for authenticated users or specific network segments.
To mitigate this vulnerability, immediate patching is required by upgrading evolution-api to a version later than 2.3.7 where the array comparison logic has been corrected to properly validate IP addresses against the whitelist configuration. In environments where an upgrade cannot be performed immediately due to compatibility constraints, organizations should implement compensating controls at the network perimeter level. This includes configuring firewalls or reverse proxies to block external access to the /metrics endpoint entirely, ensuring that only internal monitoring systems can reach it. Additionally, deploying Web Application Firewalls with rules specifically targeting unauthorized access attempts to administrative and diagnostic endpoints can provide an additional layer of defense against exploitation until the underlying code defect is resolved. Regular security audits focusing on middleware logic and authentication flows are recommended to prevent similar misconfigurations in future development cycles.