CVE-2026-32610 - Vulnerability Analysis

Overview

Glances < 4.5.2 contains a cross-site request forgery caused by insecure CORS configuration with allow_origins=["*"] and allow_credentials=True in REST API, letting remote attackers steal sensitive data via credentialed cross-origin requests, exploit requires victim browser session.

Severity & Score

Impact

Attackers can steal sensitive system monitoring data and secrets from users with active browser sessions via cross-origin requests.

Mitigation

Update to version 4.5.2 or later.

References

• https://github.com/nicolargo/glances/commit/4465169b71d93991f1e49740fe02428291099832
• https://github.com/nicolargo/glances/releases/tag/v4.5.2
• https://github.com/nicolargo/glances/security/advisories/GHSA-9jfm-9rc6-2hfq

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🟠 CVE-2026-32610 - High (8.1) Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of t... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32610/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner