CVE-2026-32610 - Vulnerability Analysis

Overview

Glances < 4.5.2 contains a cross-site request forgery caused by insecure CORS configuration with allow_origins=["*"] and allow_credentials=True in REST API, letting remote attackers steal sensitive data via credentialed cross-origin requests, exploit requires victim browser session.

Severity & Score

Impact

Attackers can steal sensitive system monitoring data and secrets from users with active browser sessions via cross-origin requests.

Mitigation

Update to version 4.5.2 or later.

References

• https://github.com/nicolargo/glances/commit/4465169b71d93991f1e49740fe02428291099832
• https://github.com/nicolargo/glances/releases/tag/v4.5.2
• https://github.com/nicolargo/glances/security/advisories/GHSA-9jfm-9rc6-2hfq

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner