Vulnerability · Published Aug 26, 2026 · Assigned by GitHub_M

CVE-2026-75601Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Medium 4.3

In plain English

A medium-severity missing authentication in static-web-server from static-web-server. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Affected products (as reported)

Vendor	Product	Versions
static-web-server	static-web-server	< 2.44.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm x_refsource_CONFIRM
https://github.com/static-web-server/static-web-server/commit/a51444c81abb7d417fd931f5df58227dd04192f5 x_refsource_MISC