# CVE-2026-75601: Static Web Server metrics endpoint authentication bypass

Source: https://junglewise.ai/threats/cve-2026-75601-static-web-server-metrics-endpoint-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75601 · Severity: medium · CVSS 4.3 · Published 2026-08-26

Static Web Server (SWS) is a lightweight web server used to serve static files and assets. When both basic authentication and metrics features are enabled, the /metrics endpoint can be accessed without credentials, exposing sensitive operational data including virtual host names, request volumes, error rates, and active connection counts. This infrastructure disclosure could help attackers understand server topology and traffic patterns before launching targeted attacks.

## Quick answers

**Is CVE-2026-75601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75601 being exploited in the wild.

**How severe is CVE-2026-75601?** Medium severity, with a CVSS score of 4.3, published 26 August 2026.

**Which products and versions are affected?** Static Web Server through 2.43.0.

**Is there a fix for CVE-2026-75601?** A patch was published on 2026-08-26: Fixed in version 2.44.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75601 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75601?** Check whether you run Static Web Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in SWS affecting versions through 2.43.0 when both --basic-auth and --metrics flags are enabled. The root cause lies in src/handler.rs, where the request processing pipeline evaluates the /metrics endpoint before performing the basic authentication check, allowing unauthenticated remote attackers to retrieve Prometheus metrics. An attacker needs only network access to the metrics endpoint (default /metrics path); no user interaction or privileges are required. The fix, released in version 2.44.0, reorders the authentication checks to validate basic auth credentials before processing any endpoint response, including metrics.

## Affected products

- Static Web Server Static Web Server through 2.43.0

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in version 2.44.0

## References

- [https://github.com/static-web-server/static-web-server/commit/a51444c81abb7d417fd931f5df58227dd04192f5](https://github.com/static-web-server/static-web-server/commit/a51444c81abb7d417fd931f5df58227dd04192f5)
- [https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm](https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm)

## Related threats

- [Static Web Server vulnerable to a symbolic link path traversal](https://junglewise.ai/threats/cve-2025-67487-static-web-server-vulnerable-to-a-symbolic-link-path-traversal)