CVE-2026-32610 Details
Description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware` reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead of returning the literal `*` wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance. Version 4.5.2 fixes the issue.
A vulnerability in Glances, an open-source cross-platform system monitoring tool, prior to version 4.5.2, allows for cross-origin credential theft through an insecure default CORS configuration in the REST API. The server originally accepted requests from any origin while allowing credentials, which is a contradictory setup. This flaw enabled any website to make authenticated requests to the Glances API, potentially accessing sensitive system monitoring data, configuration secrets, and command line arguments from users with an active browser session. The issue has been addressed in version 4.5.2.
Users should update to Glances version 4.5.2, which corrects the CORS configuration by removing the wildcard origin allowance and disabling credentials by default. After updating, users must explicitly configure allowed origins if they require credentialed cross-origin access.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nicolargo/glances/commit/4465169b71d93991f1e49740fe02428291099832 | [email protected] | Patch |
| https://github.com/nicolargo/glances/releases/tag/v4.5.2 | [email protected] | ProductRelease Notes |
| https://github.com/nicolargo/glances/security/advisories/GHSA-9jfm-9rc6-2hfq | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nicolargo glances | < 4.5.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 21, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |