Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T17:16:40.173Z",
  "pubdate": "2026-08-17T17:16:40.173Z",
  "executiveSummary": "A CORS authorization bypass vulnerability exists in Glances prior to version 4.5.6, specifically within the RESTful API component.\nThe vulnerability type is improper Cross-Origin Resource Sharing (CORS) configuration, leading to unauthorized data exposure.\nThe flaw affects Glances versions prior to 4.5.6, impacting systems running the cross-platform monitoring tool with the RESTful API enabled.\nThe risk implication involves the potential exposure of sensitive, authenticated REST API monitoring data to arbitrary, untrusted websites.\nAn external attacker capable of luring a previously authenticated user to a malicious website can exploit this misconfiguration.\nExploitation requires the victim to have an active authenticated session or valid credentials cached within their browser, allowing the malicious origin to read sensitive API responses via cross-origin requests.",
  "technicalDetails": "The root cause of the vulnerability resides in glances/outputs/glances_restful_api.py, where the cors_origins guard mechanism implements flawed logic.\nSpecifically, the implementation utilizes exact list equality rather than validating wildcard membership correctly.\nWhen a multi-origin list is configured to contain a wildcard alongside explicit entries, the validation logic improperly handles the comparison.\nThis flawed evaluation allows requests originating from arbitrary domains to retain cors_credentials permissions.\nThe vulnerable component is the CORS validation handler within the Glances RESTful API framework.\nAll Glances versions prior to 4.5.6 containing this logic flaw are affected.\nNetwork exposure is present wherever the Glances RESTful API is accessible over HTTP/HTTPS by clients.\nThe attack flow proceeds as follows: First, a user authenticates to the Glances RESTful API, establishing a session or enabling credential-included cross-origin requests.\nSecond, the user visits an untrusted website controlled by an attacker while the authenticated session remains active.\nThird, the malicious website issues a cross-origin XMLHttpRequest or Fetch API request to the locally or remotely exposed Glances RESTful API.\nFourth, due to the faulty cors_origins guard in glances/outputs/glances_restful_api.py, the API validates the malicious origin incorrectly and responds with sensitive system monitoring data alongside permissive CORS headers including credentials.\nFinally, the untrusted website captures the authenticated REST API payload, resulting in unauthorized data exposure and potential reconnaissance for subsequent attacks."
}