Read the docs
TI-2026-25142 Aliases CVE-2026-32633GHSA-r297-p3v4-wp8m

Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

Priority HIGH 80CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00501 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed glances (nicolargo): 4.5.2Glances (PyPI): 4.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nicolargoglancesbefore 4.5.24.5.2Patch availableCNA
—Glances (PyPI)before 4.5.24.5.2Patch availableGHSA-r297-p3v4-wp8m
  • glances Vendornicolargo Affected before 4.5.2 Fixed in 4.5.2 Patch available CNA
  • Glances (PyPI) Vendor— Affected before 4.5.2 Fixed in 4.5.2 Patch available GHSA-r297-p3v4-wp8m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*before 4.5.2Vulnerablenicolargo
  • cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:* Versions before 4.5.2 Vulnerable ·nicolargo

Remediation

  • Fix · CNA glances (nicolargo) Fixed in 4.5.2
  • Fix · GHSA-r297-p3v4-wp8m Glances (PyPI) Fixed in 4.5.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32633
  2. 2026-10-03 Alias added: GHSA-r297-p3v4-wp8m

References

Exploit 1

Patch 1

Advisory 1

Other 4

  • TI-2026-25106 Glances exposes the REST API without authentication CVSS 4.0HIGH 8.7
  • TI-2026-27083 Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS CVSS 4.0HIGH 7.7
  • TI-2026-25120 Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements CVSS 3.1CRITICAL 9.1
  • TI-2026-25118 Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials CVSS 3.1HIGH 7.5
  • TI-2026-25143 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers CVSS 3.1HIGH 8.1
  • TI-2026-25119 Glances's Default CORS Configuration Allows Cross-Origin Credential Theft CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences