EUVD-2026-66709Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
UI:N because no victim action is required; attacker directly queries /metrics. All other metrics consistent with the official vector.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.
AnalysisAI
Static Web Server (SWS) through version 2.43.0 exposes its Prometheus /metrics endpoint to unauthenticated remote attackers when both the basic-auth and metrics compile-time features are simultaneously enabled, due to a middleware ordering defect in src/handler.rs that processes metrics requests before the authentication gate. Exploitation leaks operational intelligence - virtual host names, request volumes, error rates, latency histograms, and active connection counts - that can inform subsequent targeting or infrastructure mapping. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific non-default conditions must both be present: (1) the SWS binary must be compiled with both the 'basic-auth' feature flag AND the 'metrics' feature flag enabled simultaneously - neither feature is on by default, and a build with only one of the two is not vulnerable; (2) basic-auth must be configured with credentials in the server configuration (i.e., the operator must have intentionally deployed authentication). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N = 4.3) contains a notable discrepancy: UI:R implies a victim user must take some interactive action during exploitation, but the attack is a direct unauthenticated GET request to /metrics that requires no user participation whatsoever. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an SWS instance compiled with both basic-auth and metrics features sends a plain unauthenticated HTTP GET request to http://target/metrics. The server, due to the ordering defect, returns a full Prometheus text-format response before evaluating credentials, disclosing virtual host names, per-endpoint request and error counts, and connection statistics. … |
| Remediation | Upgrade to Static Web Server version 2.44.0, which relocates the metrics middleware to execute after the basic-auth guard, as confirmed by commit a51444c81abb7d417fd931f5df58227dd04192f5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today