Read the docs
TI-2026-52908 Aliases CVE-2026-75601

Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Priority MEDIUM 53CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed static-web-server (static-web-server): 2.44.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
static-web-serverstatic-web-serverbefore 2.44.02.44.0Patch availableCNA
  • static-web-server Vendorstatic-web-server Affected before 2.44.0 Fixed in 2.44.0 Patch available CNA

Remediation

  • Fix · CNA static-web-server (static-web-server) Fixed in 2.44.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75601

References

Other 2

  • TI-2025-41246 Static Web Server is vulnerable to symbolic link Path Traversal CVSS 4.0MEDIUM 5.5
  • TI-2026-21887 Static Web Server: Timing-Based Username Enumeration in Basic Authentication CVSS 3.1MEDIUM 5.3
  • TI-2024-21833 Stored Cross-site Scripting in directory listings via file names in static-web-server CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences