CVE-2026-35587

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter. The value of public_api is used directly in outbound HTTP requests without any scheme restriction or hostname/IP validation. An attacker who can modify the Glances configuration can force the application to send requests to arbitrary internal or external endpoints. Additionally, when public_username and public_password are set, Glances automatically includes these credentials in the Authorization: Basic header, resulting in credential leakage to attacker-controlled servers. This vulnerability can be exploited to access internal network services, retrieve sensitive data from cloud metadata endpoints, and/or exfiltrate credentials via outbound HTTP requests. The issue arises because public_api is passed directly to the HTTP client (urlopen_auth) without validation, allowing unrestricted outbound connections and unintended disclosure of sensitive information. Version 4.5.4 contains a patch.

• CWE-918

• https://github.com/nicolargo/glances/commit/d6808be66728956477cc4b544bab1acd71ac65fbPatch
• https://github.com/nicolargo/glances/security/advisories/GHSA-g5pq-48mj-jvw8Exploit, Mitigation, Vendor Advisory
• https://github.com/nicolargo/glances/security/advisories/GHSA-g5pq-48mj-jvw8Exploit, Mitigation, Vendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35581Emissary is a P2P based data-driven workflow engine. Prior t…7.2
• CVE-2026-35582Emissary is a P2P based data-driven workflow engine. In vers…8.8
• CVE-2026-35583Emissary is a P2P based data-driven workflow engine. Prior t…5.3
• CVE-2026-35584FreeScout is a free help desk and shared inbox built with PH…6.5
• CVE-2026-35585File Browser is a file managing interface for uploading, del…7.2
• CVE-2026-35586pyLoad is a free and open-source download manager written in…6.8
• CVE-2026-35588Glances is an open-source system cross-platform monitoring t…6.3
• CVE-2026-35589nanobot is a personal AI assistant. Versions prior to 0.1.5 …9.3
• CVE-2026-3559Philips Hue Bridge HomeKit Accessory Protocol Static Nonce A…8.1
• CVE-2026-35590libvips is a fast image processing library with low memory n…6.8
• CVE-2026-35591libvips is a fast image processing library with low memory n…7
• CVE-2026-35592pyLoad is a free and open-source download manager written in…6.5