Is CVE-2026-75601 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-75601?

CVE-2026-75601 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-75601

Description

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.