CVE-2026-75601 in Static Web Server
Summary
by MITRE • 08/26/2026
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
Static Web Server (SWS) is a lightweight, production-ready web server designed primarily for serving static files and assets with high performance and low resource consumption. While its architecture prioritizes simplicity and speed, the implementation of security features such as basic authentication must be carefully ordered to ensure that all sensitive endpoints are properly protected. In versions up through 2.43.0, a critical logic error exists in the request handling pipeline within the src/handler.rs module. Specifically, when both the basic-auth middleware and the metrics feature are enabled simultaneously, the server processes requests directed at the /metrics endpoint before validating the user credentials required by the authentication layer. This architectural flaw creates an authorization bypass vulnerability where the integrity of access controls is compromised due to incorrect ordering of security checks in the request processing chain.
The technical consequence of this misordering is that any remote attacker can retrieve Prometheus metrics without providing valid username or password credentials. The /metrics endpoint exposes a wealth of operational data including virtual host names, which reveal internal domain structures and potentially sensitive subdomain configurations; request volumes, which allow for traffic analysis and potential denial-of-service planning; error rates, which may indicate system instability or targeted attack success; latency distributions, which provide insights into server performance characteristics useful for optimizing attacks; and active connections, which can aid in mapping the current load state of the infrastructure. This information disclosure significantly expands the attack surface by providing adversaries with detailed intelligence about the target environment without needing to authenticate first.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as the system fails to enforce proper authorization checks before granting access to sensitive data. It also relates to CWE-200 Information Exposure, where security-relevant information is disclosed to an unauthorized actor. In terms of offensive cyber operations mapping, this behavior corresponds to ATT&CK technique T1592 Gather Victim Host Information, specifically sub-technique T1592.004 which involves gathering network share or directory names, as well as general reconnaissance activities that rely on metadata leakage from monitoring endpoints like Prometheus exporters. The exposure of internal metrics allows attackers to perform passive fingerprinting and infrastructure mapping with minimal risk of detection compared to active scanning techniques.
The operational impact extends beyond simple information disclosure. Knowledge of virtual host names can facilitate targeted phishing campaigns or domain spoofing attacks against specific organizational units identified in the metrics output. Understanding request volumes and latency distributions enables adversaries to identify peak usage times for launching denial-of-service attacks that are more likely to cause service disruption while evading basic rate-limiting thresholds designed around average load patterns. Furthermore, awareness of error rates can help attackers pinpoint unstable components or misconfigured services within the infrastructure, allowing them to focus exploitation efforts on weaker points in the system architecture rather than wasting resources on robustly configured segments.
To mitigate this vulnerability, organizations running Static Web Server versions prior to 2.44.0 must upgrade immediately to version 2.44.0 where the issue has been resolved by correcting the middleware ordering logic. Until an upgrade is feasible, administrators should consider disabling the metrics feature if basic authentication is required for other parts of the server, thereby removing the exposed endpoint entirely. Alternatively, implementing a reverse proxy such as Nginx or Apache in front of Static Web Server can enforce authentication at the network edge before requests reach the application layer, effectively bypassing the internal logic flaw by ensuring that all traffic to sensitive paths requires valid credentials regardless of how the underlying server processes them internally. Regular security audits and static analysis tools should be employed during development to detect similar middleware ordering issues in future updates or custom configurations.