Log in / Sign up

Vulnerability details

CVE-2026-34839

nicolargo glances

Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

CVSS 4.0
7.7High

Official description

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (`/api/4/*`) is also affected and exposes significantly more sensitive data. Version 4.5.4 patches the issue.

CVSS scores

ScoreVersionSourceVector
7.7High 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Affected products

VendorProductVersionsSource
nicolargo glances < 4.5.4 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-04-21
Last updated
2026-04-21
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.4%
Probability of exploitation in 30 days
35.3%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-200
    Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-942
    Permissive Cross-domain Policy with Untrusted Domains
  • CWE-306
    Missing Authentication for Critical Function