CVE-2026-32633 Details
Description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.
A vulnerability exists in the Glances open-source system monitoring tool, specifically in Central Browser mode, prior to version 4.5.2. The issue arises because the '/api/4/serverslist' endpoint can return raw server objects that include a 'uri' field with embedded HTTP Basic credentials for downstream Glances servers. This occurs when the front Glances Browser/API instance is started without a password, a common practice for internal network deployments. In this scenario, the endpoint is completely unauthenticated, allowing any network user to retrieve reusable credentials for protected downstream servers that have been polled by the browser instance.
Users should update to Glances version 4.5.2 or later, where this vulnerability has been addressed. After upgrading, review the 'outputs' section of the glances.conf file to configure the CORS policy and host header validation as needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8m | CISA-ADP | ExploitVendor Advisory |
| https://github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361e | [email protected] | Patch |
| https://github.com/nicolargo/glances/releases/tag/v4.5.2 | [email protected] | Release Notes |
| https://github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8m | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nicolargo glances | < 4.5.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | New CVE Received | [email protected] |