CVE-2026-91997 Details

A vulnerability in Evolution API versions through 2.3.7 allows unauthenticated access to the /metrics endpoint, bypassing IP whitelist restrictions. The issue arises from an incorrect array comparison in the metricsIPWhitelist middleware, which fails to properly evaluate allowed IPs. As a result, sensitive metrics can be accessed without authorization, disclosing information such as the server version, database client name, configured server URL, and details about WhatsApp instances. This vulnerability specifically affects deployments with metrics allowed, a whitelist configured, and without authentication requirements.

To address this vulnerability, the array comparison in the metricsIPWhitelist middleware should be corrected to check the length of the filtered array instead of using strict equality with zero. Additionally, consider enabling METRICS_AUTH_REQUIRED by default to reduce the risk of misconfiguration.