Executive brief
evolution-api is an open-source WhatsApp integration API used to embed messaging capabilities into applications. A flaw in the IP whitelist validation for the /metrics endpoint allows attackers to bypass access controls and retrieve sensitive information including server version, database details, and WhatsApp instance configuration, even without authentication.
Technical details
The vulnerability exists in the metricsIPWhitelist middleware where an incorrect array comparison always evaluates to false, rendering the IP whitelist check ineffective. This allows unauthenticated attackers on the network to access the /metrics endpoint without restriction. The vulnerable component is in the middleware logic that should validate incoming request IP addresses against a whitelist. Attackers can retrieve sensitive operational metrics that disclose server version, database client names, configured URLs, and WhatsApp instance details. The issue affects evolution-api through version 2.3.7 and is fixed in later releases.
Affected products
- evolution-foundation evolution-api through 2.3.7
Timeline
- 2026-09-15: disclosed