{"apiVersion":"1.0","identifier":"CVE-2026-75601","description":"Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.","publishedAt":"2026-08-26T20:18:00","lastModifiedAt":"2026-08-26T20:18:00","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75601","cvssScore":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","epssProbability":0.0023,"riskScore":0.44,"affectedProduct":"Static Web Server","affectedVersions":"<=2.43.0","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-75601","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-75601","en":"https://www.redsauce.net/en/cves/CVE-2026-75601","fr":"https://www.redsauce.net/fr/cves/CVE-2026-75601","pt":"https://www.redsauce.net/pt/cves/CVE-2026-75601","de":"https://www.redsauce.net/de/cves/CVE-2026-75601","sk":"https://www.redsauce.net/sk/cves/CVE-2026-75601","el":"https://www.redsauce.net/el/cves/CVE-2026-75601"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-75601"}}