CVE-2026-75601mediumCWE-306

CVE-2026-75601: fallo de gravedad media en static-web-server

Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear static-web-server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.4%
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Productos afectados
static-web-server · static-web-server
CVEs relacionadas — static-web-server

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-67487MEDIUMStatic Web Server is vulnerable to symbolic link Path TraversalEPSS 0.4%CVE-2026-27480MEDIUMStatic Web Server: Timing-Based Username Enumeration in Basic AuthenticationEPSS 0.4%CVE-2024-32966MEDIUMStored Cross-site Scripting in directory listings via file names in static-web-serverEPSS 0.4%