CVE-2026-34839

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (`/api/4/*`) is also affected and exposes significantly more sensitive data. Version 4.5.4 patches the issue.

• CWE-200
• CWE-306
• CWE-942
• CWE-306

• https://github.com/nicolargo/glances/commit/fdfb977b1d91b5e410bc06c4e19f8bedb0005ce9Patch
• https://github.com/nicolargo/glances/security/advisories/GHSA-gfc2-9qmw-w7vhExploit, Vendor Advisory
• https://github.com/nicolargo/glances/security/advisories/GHSA-gfc2-9qmw-w7vhExploit, Vendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34833Bulwark Webmail is a self-hosted webmail client for Stalwart…7.5
• CVE-2026-34834Bulwark Webmail is a self-hosted webmail client for Stalwart…7.5
• CVE-2026-34835Rack is a modular Ruby web server interface. From versions 3…6.5
• CVE-2026-34836Combodo iTop is a web based IT service management tool. Prio…6.5
• CVE-2026-34837Zammad is a web based open source helpdesk/customer support …4.3
• CVE-2026-34838Group-Office is an enterprise customer relationship manageme…9.9
• CVE-2026-3484A vulnerability was detected in PhialsBasement nmap-mcp-serv…8.8
• CVE-2026-34840OneUptime is an open-source monitoring and observability pla…8.1
• CVE-2026-34841Bruno is an open source IDE for exploring and testing APIs. …9.8
• CVE-2026-34847hoppscotch is an open source API development ecosystem. Prio…6.1
• CVE-2026-34848hoppscotch is an open source API development ecosystem. Prio…5.4
• CVE-2026-34849UAF vulnerability in the screen management module. Impact: S…4.7