Skip to content
OpenAdvisories

Product · evolution-foundation

evolution-api

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-91997

    evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

    evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitiv…

    evolution-foundation evolution-api