PT-2026-33776 · Glance · Glance

Published 2026-04-20 · Updated 2026-04-22 · CVE-2026-34839

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.4

Description The web server exposes a REST API endpoint '/api/4/*' that is accessible without authentication. Due to a permissive Cross-Origin Resource Sharing (CORS) policy, specifically the 'Access-Control-Allow-Origin: *' header, the server allows cross-origin requests from any origin. This enables a malicious website to read sensitive system information from a running instance via the victim's browser, leading to cross-origin data exfiltration. The '/api/4/all' endpoint returns extensive data, including the processlist, hostname, OS, CPU info, memory and disk usage, network interfaces, IP addresses, and running services.

Recommendations Update to version 4.5.4.

Exploit

Fix

Information Disclosure

Missing Authentication

Weakness Enumeration

CWE-200

CWE-306

CWE-942

Related Identifiers

CVE-2026-34839

GHSA-GFC2-9QMW-W7VH

OPENSUSE-SU-2026:10602-1

Affected Products

Glance

References · 18

• 🔥 https://github.com/nicolargo/glances/security/advisories/GHSA-gfc2-9qmw-w7vh · Exploit
• https://github.com/nicolargo/glances/commit/fdfb977b1d91b5e410bc06c4e19f8bedb0005ce9 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10602-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34839 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34839 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34839 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34839 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34839 · Security Note
• https://osv.dev/vulnerability/GHSA-gfc2-9qmw-w7vh · Vendor Advisory
• https://github.com/nicolargo/glances · Note
• https://reddit.com/r/glances/comments/1sqrqk9/glances_454_is_released · Reddit Post
• https://twitter.com/CVEnew/status/2046571871995621427 · Twitter Post
• https://suse.com/security/cve/CVE-2026-35587 · Note
• https://suse.com/security/cve/CVE-2026-34839 · Note