The flaw in static-web-server allows an unauthenticated user to access the /metrics endpoint when both basic-auth and metrics features are enabled. The endpoint returns Prometheus metrics that expose virtual host names, traffic volumes, error rates, latency distributions, and active connections, giving an attacker detailed visibility into the server’s operation and potentially enabling targeted attacks or traffic analysis.

The vulnerability affects static-web-server versions 2.43.0 and earlier. The product implements a basic authentication guard that is bypassed when metrics are enabled, resulting in exposed metric data. The issue was fixed in static-web-server 2.44.0.

The CVSS score of 4.3 indicates moderate severity focused on confidentiality. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. An attacker can reach the metrics endpoint remotely over HTTP, bypass authentication, and obtain sensitive server telemetry. Because the data exposed is limited to metrics, the potential damage is primarily informational but still valuable for reconnaissance or attack planning.