Is CVE-2026-91997 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-91997?

CVE-2026-91997 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-91997

Description

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.