CVE-2026-91997: Evolution-Foundation Evolution-API

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

Affected products

• Evolution-Foundation Evolution-API: up to and including 2.3.7

Published 2026-09-15. Last modified 2026-09-24.