CVE-2026-75601: Static Web Server Information Disclosure

CVE-2026-75601 Overview

CVE-2026-75601 is an authentication bypass vulnerability in Static Web Server (SWS), a production-ready web server for static web files and assets. Versions through 2.43.0 process the /metrics endpoint before performing the basic-auth check in src/handler.rs. An unauthenticated remote attacker can query the endpoint and retrieve Prometheus metrics that expose virtual host names, request volumes, error rates, latency distributions, and active connections. The maintainers addressed the flaw in version 2.44.0. The issue is tracked under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated remote attackers can retrieve operational Prometheus metrics from SWS instances, disclosing virtual host inventory, traffic patterns, and error rates useful for reconnaissance.

Affected Products

Static Web Server (SWS) versions up to and including 2.43.0
Deployments with both basic-auth and metrics features enabled
Fixed in Static Web Server 2.44.0

Discovery Timeline

2026-08-26 - CVE-2026-75601 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75601

Vulnerability Analysis

Static Web Server exposes an optional Prometheus metrics endpoint at /metrics when compiled with the metrics feature. Operators typically combine this with the basic-auth feature to restrict access. The request handler in src/handler.rs evaluated the metrics endpoint before the basic-auth guard executed. Requests to /metrics therefore returned instrumentation data without any credential check.

The leaked data includes virtual host names, per-route request counts, HTTP error rates, latency histograms, and active connection counts. Attackers can use this telemetry to enumerate hosted sites, profile traffic patterns, and time follow-on attacks against high-value endpoints. Because the endpoint is reachable over the network with no user interaction against the target, exposure is limited only by network reachability.

Root Cause

The defect is an ordering error in middleware execution. The metrics pre-processor ran ahead of authentication middleware, violating the assumption that protected features honor the configured basic-auth policy. This is a classic instance of [CWE-306], where a security-relevant function lacks an authentication check on its access path.

Attack Vector

An attacker sends an HTTP GET request to the /metrics path of an SWS instance that has both basic-auth and metrics enabled. No credentials, cookies, or session state are required. The server responds with the full Prometheus exposition, disclosing operational telemetry that should have been gated by basic-auth.

rust

// Patch excerpt from src/handler.rs
// The metrics pre-processor block was removed from its early position
// so that requests fall through to the basic-auth check first.

                    return result;
                }

-               // Metrics endpoint check
-               #[cfg(feature = "metrics")]
-               if let Some(result) = metrics::pre_process(&self.opts, req) {
-                   return result;
-               }
-
                // CORS
                if let Some(result) = cors::pre_process(&self.opts, req) {
                    return result;

Source: GitHub commit a51444c. The fix relocates the metrics endpoint handling so authentication middleware executes first.

Detection Methods for CVE-2026-75601

Indicators of Compromise

Unauthenticated HTTP GET requests to /metrics on SWS hosts, especially from external or non-monitoring source addresses.
Access log entries showing 200 OK responses to /metrics without a preceding Authorization: Basic header.
Spikes in /metrics request volume that do not correlate with the known Prometheus scrape schedule.

Detection Strategies

Inventory SWS deployments and record the running version to identify instances at or below 2.43.0.
Compare requesting client IP addresses against an allowlist of legitimate Prometheus scrapers.
Alert on responses to /metrics that contain http_requests_total or process_start_time_seconds when the requester is not authenticated.

Monitoring Recommendations

Forward SWS access logs to a centralized logging pipeline and retain them for retrospective review.
Enable network-level telemetry (NetFlow, VPC flow logs) to identify external hosts reaching the metrics port.
Configure a synthetic probe that periodically requests /metrics without credentials to confirm the endpoint is no longer publicly accessible after patching.

How to Mitigate CVE-2026-75601

Immediate Actions Required

Upgrade Static Web Server to version 2.44.0 or later on all affected hosts.
Rotate any credentials, tokens, or internal hostnames that may have been inferred from the exposed metrics.
Restrict inbound access to the SWS listener so only trusted networks can reach the service until the upgrade completes.

Patch Information

The upstream fix is delivered in Static Web Server 2.44.0. Commit a51444c81abb7d417fd931f5df58227dd04192f5 removes the early metrics pre-processor call in src/handler.rs, ensuring the basic-auth guard runs before the /metrics handler. See the GitHub Security Advisory GHSA-97q6-jph8-rxgm for full advisory details.

Workarounds

Disable the metrics feature in the SWS configuration if Prometheus scraping is not required.
Bind the metrics endpoint to a loopback interface or private management network and block external access at the firewall.
Place SWS behind a reverse proxy that enforces authentication on /metrics independently of SWS.

bash

# Example: block external access to /metrics with an upstream reverse proxy (nginx)
location = /metrics {
    allow 10.0.0.0/8;      # internal Prometheus scrapers
    deny all;
    proxy_pass http://127.0.0.1:8080/metrics;
}