CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled
Unauthenticated attackers can access Prometheus metrics on Static Web Server when basic-auth and metrics are enabled, exposing operational data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-75601?
CVE-2026-75601 is a medium-severity authentication bypass vulnerability in static-web-server, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.
Weakness: CWE-306
Which versions are affected by CVE-2026-75601?
How do I fix CVE-2026-75601?
No fix has been published for CVE-2026-75601 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-75601 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75601 exists.
Sources
Also known as GHSA-97q6-jph8-rxgm.