CVE-2026-32633

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.

• CWE-200
• CWE-522
• CWE-522

• https://github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361ePatch
• https://github.com/nicolargo/glances/releases/tag/v4.5.2Release Notes
• https://github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8mExploit, Vendor Advisory
• https://github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8mExploit, Vendor Advisory

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32628AnythingLLM is an application that turns pieces of content i…8.8
• CVE-2026-32629phpMyFAQ is an open source FAQ web application. Prior to ver…6.1
• CVE-2026-3263A vulnerability was found in go2ismail Asp.Net-Core-Inventor…8.8
• CVE-2026-32630file-type detects the file type of a file, stream, or data. …5.3
• CVE-2026-32631Git for Windows is the Windows port of Git. Versions prior t…7.4
• CVE-2026-32632Glances is an open-source system cross-platform monitoring t…5.9
• CVE-2026-32634Glances is an open-source system cross-platform monitoring t…8.1
• CVE-2026-32635Angular is a development platform for building mobile and de…9
• CVE-2026-32636ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-32638StudioCMS is a server-side-rendered, Astro native, headless …2.7
• CVE-2026-3264A vulnerability was determined in go2ismail Free-CRM up to b…8.8
• CVE-2026-32640SimpleEval is a library for adding evaluatable expressions i…9.8