Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M
CVE-2026-32610Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
High 8.1
In plain English
A high-severity security flaw in glances from nicolargo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware` reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead of returning the literal `*` wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance. Version 4.5.2 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | glances | no fix listed | DEBIAN-CVE-2026-32610 |
| Debian:13 | glances | no fix listed | DEBIAN-CVE-2026-32610 |
| Debian:14 | glances | 4.5.2+dfsg-1 | DEBIAN-CVE-2026-32610 |
| PyPI | glances | 4.5.2 | GHSA-9jfm-9rc6-2hfq |
| PyPI | glances | 4.5.2 | PYSEC-2026-2169 |
| Ubuntu:22.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-32610 |
| Ubuntu:24.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-32610 |
| Ubuntu:25.10 | glances | no fix listed | UBUNTU-CVE-2026-32610 |
| Ubuntu:26.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-32610 |
| Ubuntu:26.10 | glances | no fix listed | UBUNTU-CVE-2026-32610 |
Affected products (as reported)
Weakness: CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/nicolargo/glances/security/advisories/GHSA-9jfm-9rc6-2hfq x_refsource_CONFIRM
- https://github.com/nicolargo/glances/commit/4465169b71d93991f1e49740fe02428291099832 x_refsource_MISC
- https://github.com/nicolargo/glances/releases/tag/v4.5.2 x_refsource_MISC