Executive brief
Static Web Server (SWS) is a lightweight web server used to serve static files and assets. When both basic authentication and metrics features are enabled, the /metrics endpoint can be accessed without credentials, exposing sensitive operational data including virtual host names, request volumes, error rates, and active connection counts. This infrastructure disclosure could help attackers understand server topology and traffic patterns before launching targeted attacks.
Technical details
The vulnerability is an authentication bypass in SWS affecting versions through 2.43.0 when both --basic-auth and --metrics flags are enabled. The root cause lies in src/handler.rs, where the request processing pipeline evaluates the /metrics endpoint before performing the basic authentication check, allowing unauthenticated remote attackers to retrieve Prometheus metrics. An attacker needs only network access to the metrics endpoint (default /metrics path); no user interaction or privileges are required. The fix, released in version 2.44.0, reorders the authentication checks to validate basic auth credentials before processing any endpoint response, including metrics.
Affected products
- Static Web Server Static Web Server through 2.43.0
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in version 2.44.0