CVE-2026-91997: evolution-api Auth Bypass Vulnerability

CVE-2026-91997 Overview

CVE-2026-91997 is an authentication bypass vulnerability in Evolution API through version 2.3.7. The flaw resides in the metricsIPWhitelist middleware, which performs an incorrect array comparison that always evaluates to false. As a result, the IP allowlist restriction on the /metrics endpoint never applies as intended, and unauthenticated attackers on the network can retrieve Prometheus metrics. Exposed metrics disclose the server version, database client name, configured server URL, and WhatsApp instance details. The issue is classified under CWE-697: Incorrect Comparison.

Critical Impact
Unauthenticated network attackers can reach the /metrics endpoint on any exposed Evolution API instance and harvest reconnaissance data useful for follow-on attacks against WhatsApp automation infrastructure.

Affected Products

Evolution API versions up to and including 2.3.7
Deployments exposing the /metrics endpoint to untrusted networks
Self-hosted WhatsApp automation stacks built on Evolution API

Discovery Timeline

2026-09-15 - CVE-2026-91997 published to the National Vulnerability Database
2026-09-15 - Last updated in the NVD database
2026-09-16 - EPSS score published at 0.337% (percentile 26.922)

Technical Details for CVE-2026-91997

Vulnerability Analysis

Evolution API ships a Prometheus-compatible /metrics endpoint protected by an IP allowlist middleware named metricsIPWhitelist. The middleware is intended to compare the caller's source IP against a configured list of trusted addresses. Due to an incorrect comparison between mismatched data structures, the boolean check always returns false, so no request is ever treated as allowlisted through the intended path. Rather than deny requests, the flawed logic ends up permitting unauthenticated access to the endpoint entirely, exposing operational telemetry to any network client that can reach the service.

The leaked metrics include the running server version, the configured database client name, the server URL, and identifiers for each WhatsApp instance managed by the API. This data provides attackers with a precise map of the environment before launching targeted exploitation.

Root Cause

The root cause is an Incorrect Comparison (CWE-697) inside the middleware defined in src/api/routes/index.router.ts. The middleware compares values of incompatible types or shapes, causing the allowlist evaluation to always resolve to false. The fallback behavior does not fail closed, so the endpoint remains reachable by clients whose IPs should have been rejected. See the affected code in the Evolution API repository.

Attack Vector

Exploitation requires only network reachability to the Evolution API service. An attacker sends an unauthenticated HTTP GET request to /metrics from any source address. Because the middleware never enforces the allowlist, the server returns the full Prometheus scrape output. No credentials, user interaction, or elevated privileges are required. Refer to the VulnCheck advisory for additional technical context.

No public proof-of-concept exploit code is required beyond a standard HTTP client issuing a request to the /metrics route.

Detection Methods for CVE-2026-91997

Indicators of Compromise

Unexpected HTTP GET /metrics requests to Evolution API from IPs outside the intended monitoring subnet
Prometheus scrape traffic originating from public IP ranges or unauthorized internal hosts
Web server access logs showing 200 OK responses on /metrics for non-monitoring user agents

Detection Strategies

Alert on any /metrics request whose source IP is not on the documented monitoring allowlist
Baseline expected scrape frequency and user agent, then flag deviations such as curl, wget, or empty user agents
Inspect application logs for repeated /metrics hits followed by requests to WhatsApp instance-specific endpoints

Monitoring Recommendations

Forward Evolution API access logs to a centralized logging platform for cross-source correlation
Track outbound egress from hosts that recently queried /metrics, which may indicate reconnaissance-to-exploitation pivoting
Monitor for enumeration of WhatsApp instance identifiers observed in exposed metrics against other authenticated endpoints

How to Mitigate CVE-2026-91997

Immediate Actions Required

Restrict network access to the /metrics endpoint at the reverse proxy or firewall layer using explicit IP allowlists
Ensure Evolution API is not exposed directly to the public internet; place it behind an authenticated ingress
Rotate any secrets, tokens, or WhatsApp instance credentials that may have been fingerprinted through exposed metrics

Patch Information

At the time of publication, upgrade to a version of Evolution API newer than 2.3.7 once the maintainers release a fix. Track the Evolution API repository for the corrected middleware implementation and follow guidance in the VulnCheck advisory.

Workarounds

Block /metrics at an upstream reverse proxy (NGINX, Traefik, Caddy) and only permit trusted monitoring source IPs
Bind Prometheus scraping to a private management network or overlay VPN not reachable from user-facing interfaces
Disable the metrics feature entirely if telemetry is not required for the deployment

bash

# NGINX example: allow only trusted monitoring subnets to reach /metrics
location /metrics {
    allow 10.10.20.0/24;   # monitoring subnet
    deny  all;
    proxy_pass http://evolution_api_upstream;
}