PT-2026-33777 · Glance · Glance

Published 2026-04-20 · Updated 2026-04-22 · CVE-2026-35587

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.4

Description A Server-Side Request Forgery (SSRF) issue exists in the Glances IP plugin due to improper validation of the public api configuration parameter. The value of public api is passed directly to the urlopen auth() function without restrictions on the URL scheme, hostname, or IP address. An attacker capable of modifying the configuration can force the application to send requests to arbitrary internal or external endpoints, such as localhost, private network ranges, or cloud metadata endpoints (e.g., 'http://169.254.169.254/'). Furthermore, if public username and public password are configured, Glances automatically includes these credentials in the Authorization: Basic header, leading to credential leakage to attacker-controlled servers.

Recommendations Update to version 4.5.4. As a temporary workaround, avoid using the public api parameter in the IP plugin configuration until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-35587

GHSA-G5PQ-48MJ-JVW8

OPENSUSE-SU-2026:10602-1

Affected Products

Glance

References · 18

• 🔥 https://github.com/nicolargo/glances/security/advisories/GHSA-g5pq-48mj-jvw8 · Exploit
• https://github.com/nicolargo/glances/commit/d6808be66728956477cc4b544bab1acd71ac65fb · Patch
• https://osv.dev/vulnerability/GHSA-g5pq-48mj-jvw8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35587 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35587 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10602-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35587 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-35587 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35587 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35587 · Security Note
• https://github.com/nicolargo/glances · Note
• https://github.com/nicolargo/glances/releases/tag/v4.5.4 · Note
• https://reddit.com/r/glances/comments/1sqrqk9/glances_454_is_released · Reddit Post
• https://suse.com/security/cve/CVE-2026-35587 · Note
• https://twitter.com/VulmonFeeds/status/2046472017193386223 · Twitter Post