Description

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-15T12:17:55.240Z",
  "pubdate": "2026-09-15T12:17:55.240Z",
  "executiveSummary": "The evolution-api platform, in versions through 2.3.7, contains a critical security flaw within its middleware configuration. The vulnerability consists of an incorrect array comparison logic located in the metricsIPWhitelist function. This implementation error results in the whitelist check consistently evaluating to false, effectively neutralizing intended access control mechanisms for the /metrics endpoint.\nThe vulnerability allows remote, unauthenticated attackers to bypass IP-based restrictions, granting unauthorized access to the application's metrics. The exposure of this endpoint is high-risk, as it discloses sensitive operational and environmental telemetry. An attacker can obtain detailed information, including the server version, underlying database client identity, configured server URLs, and specific WhatsApp instance identifiers.\nThis exposure facilitates reconnaissance that can be used to inform further exploitation efforts against the infrastructure. Given that the vulnerability requires no authentication and bypasses existing access controls, it represents a significant security oversight for deployments relying on network-level filtering to secure their management interfaces.",
  "technicalDetails": "The vulnerability resides within the evolution-api metricsIPWhitelist middleware component. The root cause of the flaw is a logical error during the array comparison process utilized to validate incoming request IP addresses against a predefined whitelist. Due to a flawed implementation in the comparison logic, the conditional statement responsible for verifying the client's IP address always returns false, regardless of the source IP.\nBecause the middleware fails to perform a valid comparison, it essentially ignores the security policy that is intended to restrict access to the /metrics endpoint to trusted IP ranges. Consequently, the API fails to enforce any access control, allowing any unauthenticated remote client to access the sensitive endpoint.\nThe attack flow involves the following steps: 1) The attacker targets the public-facing URL of the evolution-api instance. 2) The attacker issues an unauthenticated HTTP GET request to the /metrics endpoint. 3) The metricsIPWhitelist middleware intercepts the request. 4) The middleware executes the flawed comparison logic, which evaluates the whitelist condition as false. 5) Under normal circumstances, the middleware would deny access; however, due to the logic error, the request proceeds to the metrics handler. 6) The application returns a full dump of metrics data to the attacker.\nThe impact of this vulnerability is significant, as it provides an information disclosure vector. The /metrics endpoint reveals system state information that would otherwise be protected. Specifically, the exposed data includes server versioning (aiding in targeted exploit identification), database client names, internal API URLs, and configuration details for connected WhatsApp instances. This information is highly valuable for threat actors conducting reconnaissance against evolution-api deployments, potentially allowing them to identify specific service configurations or dependencies to pivot for further exploitation or to launch targeted attacks against the WhatsApp integration."
}