VulnSocial

CVE-2026-75601Patch

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-03: 1Patch / Workaround · 2026-09-03: 1Technical Details · 2026-09-03: 109-03
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • t fuku@tfuku816150
    Patch

    Static Web Server (SWS) の認証バイパス脆弱性を発見・報告し、CVE-2026-75601 が割り当てられました。 Basic Auth 有効時でも /metrics に未認証でアクセスできる問題です。 CVE-2026-75601 CWE-306 CVSS 4.3 (Medium) Fixed in v2.44.0

    Post summary

    A Basic Auth bypass vulnerability (CVE-2026-75601) was disclosed with a CVSS score of 4.3, and a patch is available in version 2.44.0.

    00030274
    138 followersView on X

Explore more

Back to dashboard