CVE-2026-33533

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). This issue has been patched in version 4.5.3.

• CWE-942

• https://github.com/nicolargo/glances/commit/dcb39c3f12b2a1eec708c58d22d7a1d62bdf5fa1Patch
• https://github.com/nicolargo/glances/releases/tag/v4.5.3Product, Release Notes
• https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7Exploit, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33528GoDoxy is a reverse proxy and container orchestrator for sel…6.5
• CVE-2026-33529Zoraxy is a general purpose HTTP reverse proxy and forwardin…8.8
• CVE-2026-3353The Comment SPAM Wiper plugin for WordPress is vulnerable to…4.4
• CVE-2026-33530InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-33531InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-33532`yaml` is a YAML parser and serialiser for JavaScript. Parsi…4.3
• CVE-2026-33534EspoCRM is an open source customer relationship management a…4.3
• CVE-2026-33535ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-33536ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-33537Lychee is a free, open-source photo-management tool. The pat…5
• CVE-2026-33538Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-33539Parse Server is an open source backend that can be deployed …7.2