CVE-2026-46608 Details
Description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE-2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: * whenever cors_origins contains more than one entry. An operator who configures an explicit two-entry allowlist (e.g. two internal dashboard origins) intending to restrict browser access instead receives the unrestricted wildcard. A malicious web page served from any origin can issue a CORS simple request to /RPC2 and read the full system monitoring dataset without the victim's knowledge. This vulnerability is fixed in 4.5.5.
A vulnerability exists in the Glances XML-RPC server (glances -s) prior to version 4.5.5, due to an improper handling of CORS origins. While version 4.5.3 introduced a configurable CORS origin list to mitigate a previous vulnerability (CVE-2026-33533), the implementation incorrectly defaults to Access-Control-Allow-Origin: * when more than one origin is specified. This flaw allows a malicious web page to make CORS requests to the Glances server and access sensitive system monitoring data without the user's knowledge. The vulnerability affects Glances versions through 4.5.5_dev1.
Users can update to Glances version 4.5.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nicolargo/glances/releases/tag/v4.5.5 | [email protected] | Release NotesVendor |
| https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-183 | Permissive List of Allowed Inputs | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Glances | <= 4.5.5_dev1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |