Evolution Api
Monthly
Unauthenticated information disclosure in Evolution API through 2.3.7: an incorrect array comparison in the metricsIPWhitelist middleware always evaluates to false, so the IP allowlist check never enforces and any network attacker can reach the Prometheus /metrics endpoint. The exposed metrics leak server version, database client name, configured server URL and WhatsApp instance details, which is useful reconnaissance material for follow-on attacks against self-hosted WhatsApp gateways. Publicly available exploit code exists (VulnCheck-reported, with a linked GitHub write-up); the issue is not listed in CISA KEV and no EPSS score was provided in the input.
Unauthenticated information disclosure in Evolution API through 2.3.7: an incorrect array comparison in the metricsIPWhitelist middleware always evaluates to false, so the IP allowlist check never enforces and any network attacker can reach the Prometheus /metrics endpoint. The exposed metrics leak server version, database client name, configured server URL and WhatsApp instance details, which is useful reconnaissance material for follow-on attacks against self-hosted WhatsApp gateways. Publicly available exploit code exists (VulnCheck-reported, with a linked GitHub write-up); the issue is not listed in CISA KEV and no EPSS score was provided in the input.