PT-2026-49094 · Glance · Glance
CVSS v3.1
7.4
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Glances versions prior to 4.5.5
Description
The XML-RPC server (
glances -s) contains a misconfiguration in its Cross-Origin Resource Sharing (CORS) implementation. When the cors origins variable is configured with more than one entry, the system silently reverts to using a wildcard (Access-Control-Allow-Origin: *), effectively bypassing intended access restrictions. This allows a malicious web page from any origin to send a CORS simple request to the /RPC2 endpoint and read the full system monitoring dataset, including the hostname, OS version, full process list (which may contain sensitive tokens or passwords), and network statistics.Recommendations
Update to version 4.5.5.
As a temporary mitigation, restrict the
cors origins configuration to a single origin or avoid using the XML-RPC server in favor of the REST API (glances -w).Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Glance