CVE-2026-32634 Details

A vulnerability in Glances, an open-source cross-platform system monitoring tool, allows for the exfiltration of reusable authentication credentials in Central Browser mode. Prior to version 4.5.2, Glances improperly trusted Zeroconf-advertised server names for dynamic servers, leading to a credential leak. When a dynamic server, advertised as 'protected', is accessed, Glances uses the untrusted name to look up saved passwords and generate connection URIs. This flaw enables an attacker on the same local network to spoof a Glances service, causing the victim's browser to send authentication secrets to an attacker-controlled host. The vulnerability affects both background polling and REST/WebUI interactions in Central Browser mode.

Users should update to Glances version 4.5.2, which addresses this vulnerability by ensuring that the application uses the discovered IP address for dynamic servers instead of the advertised name. Additionally, the updated version prevents dynamic server entries from inheriting saved or default credentials, requiring manual authentication for each server.