CVE-2026-75601

Received Received - Intake

Static Web Server Prometheus Metrics Exposure via Unauthenticated Access

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-75601

Affected Vendors & Products

Vendor	Product	Version / Range
static_web_server	static_web_server	2.44.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Static Web Server (SWS) versions up to 2.43.0 have a flaw where the /metrics endpoint is processed before basic authentication checks. This allows unauthenticated attackers to access Prometheus metrics that reveal sensitive information like virtual host names, request volumes, error rates, latency, and active connections.

Detection Guidance

Check if Static Web Server (SWS) version 2.43.0 or earlier is running with both basic-auth and metrics features enabled. Inspect network traffic for unauthenticated requests to the /metrics endpoint. Verify if Prometheus metrics are exposed without authentication.

Impact Analysis

An attacker could exploit this to gather intelligence about your server's traffic patterns, identify active services, and potentially plan further attacks. The exposed metrics may also reveal internal infrastructure details that could aid in compromising other systems.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by exposing sensitive operational data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. Unauthorized access to metrics could lead to compliance breaches.

Mitigation Strategies

Upgrade Static Web Server (SWS) to version 2.44.0 or later to fix the issue. If upgrading is not immediately possible, disable the metrics feature or restrict access to the /metrics endpoint via network policies or firewall rules.

Hi! I’m here to help you understand CVE-2026-75601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70