PT-2026-25844 · Glance+1 · Glance+1

Dhiyaneshgeek · Published 2026-03-14 · Updated 2026-05-08 · CVE-2026-32596

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.2

Description Glances, a system cross-platform monitoring tool, has an issue where the web server runs without authentication by default when started with glances -w. This exposes a REST API containing sensitive system information, including process command-lines that may contain credentials like passwords, API keys, and tokens, to any network client. The API endpoints, such as /api/4/system and /api/4/all, allow access to system information, process lists, network connections, filesystems, and Docker containers. The vulnerable code resides in files like glances/outputs/glances restful api.py and glances/plugins/processlist/ init .py. The cmdline parameter within the process list API (/api/4/processlist) exposes full command-line arguments without sanitization. This can lead to complete system reconnaissance and credential harvesting, potentially enabling lateral movement and targeted attacks.

Recommendations Versions prior to 4.5.2 should be updated to version 4.5.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-04359

CVE-2026-32596

GHSA-WVXV-4J8Q-4WJQ

OPENSUSE-SU-2026:10415-1

Affected Products

Glance

Red Os

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32596.json · Exploit
• https://github.com/nicolargo/glances/commit/208d876118fea5758970f33fd7474908bd403d25 · Patch
• https://github.com/nicolargo/glances/security/advisories/GHSA-wvxv-4j8q-4wjq · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04359 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-32596 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wvxv-4j8q-4wjq · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32596 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32596 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32596 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32596 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32596 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32596 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10415-1 · Vendor Advisory
• https://github.com/nicolargo/glances · Note
• https://github.com/nicolargo/glances/releases/tag/v4.5.2 · Note