CVE-2026-35587 Glances IP Plugin has SSRF via public_api that leads to credential leakage
Attackers with config access can trigger SSRF to leak credentials and access internal services via the Glances IP plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35587?
CVE-2026-35587 is a high-severity server-side request forgery vulnerability in nicolargo glances, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter. The value of public_api is used directly in outbound HTTP requests without any scheme restriction or hostname/IP validation. An attacker who can modify the Glances configuration can force the application to send requests to arbitrary internal or external endpoints. Additionally, when public_username and public_password are set, Glances automatically includes these credentials in the Authorization: Basic header, resulting in credential leakage to attacker-controlled servers. This vulnerability can be exploited to access internal network services, retrieve sensitive data from cloud metadata endpoints, and/or exfiltrate credentials via outbound HTTP requests. The issue arises because public_api is passed directly to the HTTP client (urlopen_auth) without validation, allowing unrestricted outbound connections and unintended disclosure of sensitive information. Version 4.5.4 contains a patch.
Weakness: CWE-918
Which versions are affected by CVE-2026-35587?
3 open source packages ship an affected version, including glances. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
glances PyPI | All versions | 4.5.4 |
glances PyPI | All versions | 4.5.4 |
glances PyPI | All versions | 4.5.4 |
Products include Nicolargo Glances.
How do I fix CVE-2026-35587?
Upgrade glances to 4.5.4 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-35587 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35587 exists.
Other vulnerabilities in nicolargo glances
- CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
- CVE-2026-32596 Glances exposes the REST API without authentication
- CVE-2026-30928 Glances Exposes Unauthenticated Configuration Secrets
- CVE-2026-32610 Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
- CVE-2026-32634 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
Sources
Also known as DEBIAN-CVE-2026-35587, GHSA-g5pq-48mj-jvw8, PYSEC-2026-2176, UBUNTU-CVE-2026-35587.