CVE-2026-75601CWE-306

CVE-2026-75601

Medium · published August 27, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-27T00:18Z
References (3)
https://github.com/static-web-server/static-web-server/commit/a51444c81abb7d417fd931f5df58227dd04192f5 · [email protected]https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm · [email protected]https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 AUG 06:53Z
    EPSS moved — → 0%
    epss
  • 26 AUG 19:53Z
    Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled
    cvelistv5