CVE-2026-34839: Glances Information Disclosure Vulnerability

CVE-2026-34839 Overview

CVE-2026-34839 is a high-severity information disclosure vulnerability in Glances, an open-source cross-platform system monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (/api/4/*) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (Access-Control-Allow-Origin: *). This configuration allows a malicious website to read sensitive system information from a running Glances instance in the victim's browser, leading to cross-origin data exfiltration.

While a previous advisory exists for XML-RPC CORS issues, this vulnerability demonstrates that the REST API (/api/4/*) is also affected and exposes significantly more sensitive data. The issue has been classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact

Attackers can leverage a malicious web page to steal sensitive system monitoring data including CPU, memory, network, and process information from any Glances instance accessible to the victim's browser.

Affected Products

• Glances versions prior to 4.5.4
• Glances web server with REST API enabled (/api/4/*)
• Installations running without authentication and default CORS configuration

Discovery Timeline

• 2026-04-21 - CVE-2026-34839 published to NVD
• 2026-04-21 - Last updated in NVD database

Technical Details for CVE-2026-34839

Vulnerability Analysis

The vulnerability exists in the Glances web server's REST API implementation, which by default exposes system monitoring endpoints without requiring authentication. Combined with a permissive CORS policy that sets Access-Control-Allow-Origin: *, this creates a dangerous attack surface where any website can make cross-origin requests to the Glances API and read the response data.

The REST API at /api/4/* provides comprehensive system monitoring data, including CPU usage, memory statistics, network interfaces, running processes, and other sensitive system metrics. An attacker can craft a malicious webpage that, when visited by a victim with an accessible Glances instance, silently exfiltrates this system information.

Root Cause

The root cause is a combination of two insecure default configurations:

1. No Authentication Required: The Glances web server runs without authentication by default, allowing any client to access the REST API
2. Permissive CORS Policy: The default CORS configuration uses Access-Control-Allow-Origin: *, which permits any origin to make cross-origin requests and read response data

This combination violates the Same-Origin Policy protections that browsers normally enforce, enabling cross-origin data theft attacks.

Attack Vector

The attack follows a cross-origin data exfiltration pattern:

1. Attacker hosts a malicious webpage containing JavaScript code
2. Victim visits the malicious page while having access to a Glances instance (e.g., on localhost or internal network)
3. The malicious JavaScript makes fetch requests to the Glances REST API endpoints
4. Due to the permissive CORS policy, the browser allows the JavaScript to read the API responses
5. Sensitive system information is exfiltrated to the attacker's server

The following patch shows the security fix implemented in version 4.5.4:

         print(self._logo())
 
         # Security warnings
-        if not self.args.password:
-            is_localhost = self.args.bind_address in ('127.0.0.1', 'localhost', '::1')
+        cors_origins = self.config.get_list_value('outputs', 'cors_origins', default=["*"])
+        if not self.args.password and cors_origins == ["*"]:
             warn_lines = [
-                "WARNING: Glances web server is running WITHOUT authentication.",
+                "WARNING: Glances web server is running without authentication and with permissive",
+                "         CORS (Access-Control-Allow-Origin: *). Any web page reachable from your",
+                "         browser can read system metrics. Consider binding to 127.0.0.1, enabling",
+                "         authentication, or setting cors_origins in glances.conf.",
+                "         See https://glances.readthedocs.io/en/latest/api/restful.html#security",
             ]
+            print('\n'.join(warn_lines) + '\n')
+            logger.warning(
+                "Glances web server is running without authentication and with permissive CORS "
+                "(Access-Control-Allow-Origin: *)"
+            )
+        elif not self.args.password:
+            warn_lines = [
+                "WARNING: Glances web server is running without authentication.",
+            ]
+            is_localhost = self.args.bind_address in ('127.0.0.1', 'localhost', '::1')
             if is_localhost:
                 warn_lines.append("         Use --password to enable authentication.")
             else:

Source: GitHub Commit

Detection Methods for CVE-2026-34839

Indicators of Compromise

• Unexpected cross-origin requests to Glances REST API endpoints (/api/4/*) in web server logs
• Requests to Glances API from external or untrusted IP addresses
• Unusual patterns of API access from browser-based clients
• Network traffic showing Glances API responses being sent to external domains

Detection Strategies

• Monitor web server access logs for requests to /api/4/* endpoints from unexpected origins
• Implement network-level monitoring to detect cross-origin API requests
• Review Glances configuration for missing authentication settings
• Audit CORS headers in HTTP responses from Glances instances

Monitoring Recommendations

• Enable detailed logging for the Glances web server to capture all API requests
• Deploy network intrusion detection rules to identify suspicious cross-origin request patterns
• Implement egress monitoring to detect potential data exfiltration from internal systems
• Use SentinelOne to monitor for suspicious browser-based network activity targeting internal services

How to Mitigate CVE-2026-34839

Immediate Actions Required

• Upgrade Glances to version 4.5.4 or later immediately
• Enable authentication using the --password flag when starting the Glances web server
• Restrict CORS origins to trusted domains by configuring cors_origins in glances.conf
• Bind Glances to 127.0.0.1 or localhost if remote access is not required

Patch Information

The vulnerability has been patched in Glances version 4.5.4. The fix introduces improved warning messages for insecure configurations and provides clearer guidance on securing the REST API. For detailed information about the security fix, refer to the GitHub Security Advisory and the commit implementing the patch.

Workarounds

• Enable authentication by starting Glances with the --password flag
• Configure restrictive CORS origins in glances.conf to limit allowed origins
• Bind the Glances web server to localhost only using --bind 127.0.0.1
• Use network firewall rules to restrict access to Glances ports from untrusted networks

# Configuration example
# Enable authentication when starting Glances web server
glances -w --password

# Or bind to localhost only to prevent remote access
glances -w --bind 127.0.0.1

# Configure CORS origins in glances.conf
# [outputs]
# cors_origins=https://trusted-domain.example.com