CVE-2026-32610 Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
Default CORS settings allow malicious websites to steal system monitoring data and secrets from users with active Glances sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32610?
CVE-2026-32610 is a high-severity vulnerability in nicolargo glances, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware` reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead of returning the literal `*` wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance. Version 4.5.2 fixes the issue.
Weakness: CWE-942
Which versions are affected by CVE-2026-32610?
3 open source packages ship an affected version, including glances and Glances. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
glances PyPI | All versions | 4.5.2 |
glances PyPI | All versions | 4.5.2 |
Glances PyPI | All versions | 4.5.2 |
Products include Nicolargo Glances.
How do I fix CVE-2026-32610?
Upgrade glances to 4.5.2 or later.
Is CVE-2026-32610 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32610 exists.
Other vulnerabilities in nicolargo glances
- CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
- CVE-2026-32596 Glances exposes the REST API without authentication
- CVE-2026-30928 Glances Exposes Unauthenticated Configuration Secrets
- CVE-2026-32634 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
- CVE-2026-33641 Glances Vulnerable to Command Injection via Dynamic Configuration Values
Sources
Also known as DEBIAN-CVE-2026-32610, GHSA-9jfm-9rc6-2hfq, PYSEC-2026-2169, UBUNTU-CVE-2026-32610.