Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M

CVE-2026-32633Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

Critical 9.1

In plain English

A critical-severity information exposure in glances from nicolargo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 56.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	glances	no fix listed	DEBIAN-CVE-2026-32633
Debian:13	glances	no fix listed	DEBIAN-CVE-2026-32633
Debian:14	glances	4.5.2+dfsg-1	DEBIAN-CVE-2026-32633
PyPI	glances	4.5.2	GHSA-r297-p3v4-wp8m
PyPI	glances	4.5.2	PYSEC-2026-343
Ubuntu:22.04:LTS	glances	no fix listed	UBUNTU-CVE-2026-32633
Ubuntu:24.04:LTS	glances	no fix listed	UBUNTU-CVE-2026-32633
Ubuntu:25.10	glances	no fix listed	UBUNTU-CVE-2026-32633
Ubuntu:26.04:LTS	glances	no fix listed	UBUNTU-CVE-2026-32633
Ubuntu:26.10	glances	no fix listed	UBUNTU-CVE-2026-32633

Affected products (as reported)

Vendor	Product	Versions
nicolargo	glances	< 4.5.2

Weakness: CWE-200, CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8m x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361e x_refsource_MISC
https://github.com/nicolargo/glances/releases/tag/v4.5.2 x_refsource_MISC