CVE-2026-32633
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.47%
- CWE
- CWE-200, CWE-522
- Published
- 2026-03-18
- Last modified
- 2026-03-19
Affected products
- nicolargo glances
Weakness type
Related vulnerabilities
- CVE-2026-87017 — Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
- CVE-2026-86767 — Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
- CVE-2026-87820 — CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
- CVE-2026-87810 — Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
- CVE-2026-87032 — Tanium addressed an information disclosure vulnerability in Tanium Server.
- CVE-2026-87035 — Tanium addressed an information disclosure vulnerability in Comply.
- CVE-2026-87593 — Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87437 — Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...