Protect Your System: Mitigating CVE-2026-91997 in the Evolution API

The vulnerability CVE-2026-91997 directly impacts development and operations teams using the Evolution API in production environments. This flaw allows remote code execution through an unauthenticated endpoint, jeopardizing the integrity of integrated systems and processed data. In this guide, Hcode provides a detailed technical explanation of the issue, practical update guidance, and examples to protect your application assertively, without alarmism, but with the necessary rigor for critical environments.

Understanding CVE-2026-91997 in the Evolution API

CVE-2026-91997 refers to a vulnerability discovered in the Evolution API, particularly relevant for those using the feature to integrate chatbots into automation workflows. The issue was identified in version 2.3.5 and arises from the exposure of a critical endpoint without authentication, allowing anyone to send requests capable of executing arbitrary commands on the server's backend. This could lead to unauthorized access, data manipulation, and service disruption.

The risk is compounded by the simplicity of exploitation: it is enough to identify the exposed endpoint to execute malicious commands. Environments where the API is directly accessible via the internet, without additional filters, become especially susceptible.

How the vulnerability can be exploited

The core of the flaw lies in the lack of authentication on certain endpoints. As a result, HTTP requests sent to the vulnerable endpoint are processed without validation of origin or credentials. An attacker can, for example, execute commands on the server using a payload in JSON:

curl -X POST http://yoursite:port/vulnerable-endpoint -d '{"action": "execute_command", "command": "ls /"}'

This scenario allows for the execution of operating system commands, installation of scripts, or lateral movement within the environment. Automated attacks can scan large IP ranges in search of vulnerable instances, escalating the problem's scale.

Even internal environments are not immune: inadvertently exposed endpoints or misconfigured integrations can broaden the attack surface.

Response from the Evolution Foundation: update and security reinforcement

To mitigate CVE-2026-91997, the Evolution Foundation released version 2.4.0 of the API, introducing significant changes to enhance security:

• Mandatory authentication on critical endpoints: Now, any attempt to access without valid credentials is denied, drastically reducing the possibility of remote exploitation.
• Mandatory license activation: Starting with version 2.4.0, a license must be activated to use the API. Without it, the service returns error 503 with code LICENSE_REQUIRED and does not process requests.
• Path Traversal fix: The /assets endpoint has been adjusted to block attempts to access files outside the allowed scope, preventing unauthorized reading or manipulation of server files.
• Support for SOCKS proxies: The API can now be configured to route traffic through SOCKS proxies, contributing to privacy and access control in restricted environments.
• Revised security documentation: The official guides have been updated, detailing secure configuration procedures and best practices for deployment.
• Integration with multiple chatbots: Support for integrations has been expanded, facilitating connections with different chatbot platforms. This provides greater flexibility but requires a review of permissions and authentication for each integration after the update.

The license activation can be done through the Evolution API manager, via environment variable (EVOLUTION_OPERATOR_EMAIL) or through a specific endpoint. Without a valid license, the API remains unavailable until regularized.

How to mitigate CVE-2026-91997: Step by step

To protect your deployment, follow this technical roadmap:

• Identify the version in use: Check if your instance is using version 2.3.5 or earlier, using the command evolution-api --version or the manager panel.
• Perform backup: Before any changes, save important configurations and data to ensure recovery in case of an incident during the update.
• Update to version 2.4.0 or higher: Use the method compatible with your environment. For Docker, for example:

  docker pull evolutionfoundation/evolution-api:2.4.0

• Activate the license: After updating, activate the license through the manager, environment variable, or specific endpoint:

  export [email protected]

• Review authentication on endpoints: Ensure that all critical endpoints have authentication enabled. Use tokens or methods suggested by the Evolution API documentation.
• Restrict external access: Adjust firewall rules to limit API access to authorized networks and IPs, avoiding unnecessary exposure to the internet.
• Consult the official documentation: Follow the updated security guides to adapt configurations to your operational context.
• Test the protection: Attempt access without authentication to validate that the system blocks unauthorized connections.
• Monitor logs: Analyze access and authentication records to detect anomalous behaviors or attempts at exploitation.

These steps help reduce exposure to CVE-2026-91997 and strengthen the security posture of the environment.

Practical examples of mitigation in different scenarios

The application of fixes may vary according to the environment. Here are practical examples for different contexts:

• Docker Environment: Update the image in the docker-compose.yml file and set the variable for activation:

  services:
    evolution-api:
      image: evolutionfoundation/evolution-api:2.4.0
      environment:
        - [email protected]
  

  After deployment, access the manager to validate the license and review authentication settings.
• Node.js Environment: Update the package and configure the variable in the .env:

  npm install evolution-api@latest
  # In the .env file
  [email protected]
  

  Restart the application and confirm that the license is active and critical endpoints require authentication.
• Multiple Integrations: If you use different chatbots or external systems, review the permissions of each integration, adjusting authentication and authorization according to the recommendations of the new version.
• Cloud Environment: Use your provider's firewall rules to restrict access to the API. Consider reverse proxies with additional authentication if external exposure is necessary.
• Legacy or Hybrid Environments: Review plugins, custom endpoints, and existing integrations to ensure they all follow the new authentication standards set forth in the updated documentation.

Regardless of the scenario, prioritize tests for unauthenticated access and review logs after the update to ensure that protection is active.

Common mistakes when securing the Evolution API and how to avoid them

• Endpoints without authentication: After updating, it is common to forget custom routes or plugins that create additional endpoints. Audit all exposed routes to ensure adequate protection.
• License not activated: Without a valid license, the API returns error 503 and does not operate. Monitor the license status and ensure activation in all critical instances.
• Unnecessary public exposure: APIs directly accessible over the internet without restriction increase the risk of exploitation. Limit access whenever possible.
• Default settings maintained: Default installation parameters may not be suitable for production. Adjust ports, tokens, and permissions according to your organization's security policy.
• Insufficient log monitoring: Failures, attack attempts, and unauthorized access can go unnoticed without frequent log analysis. Implement alerts for suspicious events as needed.
• Outdated internal documentation: Version changes require updates to internal manuals and training for the technical team to align security procedures.
• Lack of post-update review: After updating the API, conduct access tests, review logs, and validate integrations to ensure the effectiveness of protection across the entire operational flow.

Avoiding these mistakes contributes to a more robust security posture and reduces the risk of future exposure.

Frequently Asked Questions

How do I know if my application is vulnerable to CVE-2026-91997?

If you are using the Evolution API version 2.3.5 or earlier and have not implemented reinforced authentication on all endpoints, there is a risk of exposure. Check the installed version and inventory the open endpoints. Analyze the logs to identify suspicious accesses.

What changes when updating to version 2.4.0?

The update implements mandatory authentication, requires license activation, and fixes issues such as Path Traversal. It also includes improvements in integrations, support for proxies, and overall system stability.

How can I confirm that the vulnerability has been fixed?

After updating and activating the license, attempt to access critical endpoints without authentication to ensure that the system blocks these requests. Monitor logs to identify exploitation attempts and validate settings as per the official documentation.

Do existing integrations need to be reviewed?

With changes to authentication and expanded integrations, it is recommended to review the configurations of each connected service to ensure compatibility and protection aligned with the new version of the API.

Conclusion

Protecting systems against CVE-2026-91997 is a priority for those using the Evolution API. The update to version 2.4.0 or higher, license activation, and review of access and authentication policies are essential measures to maintain the security of the environment. Invest in continuous monitoring and updating internal processes to ensure resilience against similar threats. To deepen your knowledge about API security and best practices, visit the Hcode course platform.

Sources

Evolution API: key updates and recent fixes, GitHub - evolution-foundation/evolution-api, May 17, 2026.

CVE-2026-91997: Vulnerability in the Evolution API, VulnCheck, November 4, 2026.

CVE-2026-91997, NVD, November 4, 2026.