CVE-2026-34839 Overview
CVE-2026-34839 is an information disclosure vulnerability in Glances, an open-source cross-platform system monitoring tool. Versions prior to 4.5.4 expose the REST API at /api/4/* without authentication and apply a permissive Cross-Origin Resource Sharing (CORS) policy of Access-Control-Allow-Origin: *. Any malicious website visited by a user running Glances locally can issue cross-origin requests and read system telemetry from the running instance. The flaw maps to [CWE-200] (Exposure of Sensitive Information) and [CWE-306] (Missing Authentication for Critical Function). Version 4.5.4 patches the issue.
Critical Impact
A malicious website can silently exfiltrate sensitive host data — including processes, network connections, CPU, memory, and filesystem details — from a victim's local Glances instance through the browser.
Affected Products
- Nicolargo Glances versions prior to 4.5.4
- Glances web server component exposing /api/4/* REST endpoints
- Deployments where Glances is reachable from a user's browser (localhost or LAN)
Discovery Timeline
- 2026-04-21 - CVE-2026-34839 published to NVD
- 2026-04-24 - Last updated in NVD database
Technical Details for CVE-2026-34839
Vulnerability Analysis
Glances ships a built-in web server that surfaces system metrics through a versioned REST API under /api/4/*. The server applies the header Access-Control-Allow-Origin: * to every response, instructing browsers to permit cross-origin reads from any site. The API itself requires no authentication by default. A prior advisory addressed the same permissive CORS pattern on the XML-RPC interface, but the REST API was overlooked and exposes substantially more telemetry, including process lists, network connections, sensors, filesystem layout, and Docker container metadata.
The issue is exploitable whenever a user runs Glances locally or on a host their browser can reach. Visiting a malicious page is sufficient to trigger the attack — no user interaction beyond page load is required.
Root Cause
The root cause is a combination of two design choices in the Glances web server: missing authentication on the REST API ([CWE-306]) and a wildcard CORS policy that disables the browser's same-origin protections ([CWE-200]). With both defaults in place, the browser becomes a confused deputy that authorizes data reads on behalf of any origin.
Attack Vector
An attacker hosts a page that issues fetch requests to http://127.0.0.1:61208/api/4/all or to a LAN address running Glances. Because the server returns Access-Control-Allow-Origin: *, the response body becomes readable by the attacker's JavaScript. The attacker forwards harvested data — process names, listening ports, mounted volumes, container inventories — to a remote collector. No credentials, prompts, or privileged context are required.
No public proof-of-concept exploit code is referenced in the advisory. See the GitHub Security Advisory GHSA-gfc2-9qmw-w7vh for technical details.
Detection Methods for CVE-2026-34839
Indicators of Compromise
- Inbound HTTP requests to /api/4/* on the Glances port (default 61208) carrying an Origin header that does not match the Glances host
- Web server access logs showing browser Referer values pointing to untrusted external domains
- Unexpected bursts of GET requests to endpoints such as /api/4/all, /api/4/processlist, /api/4/network, or /api/4/docker
Detection Strategies
- Inspect Glances access logs for cross-origin requests where the Origin header differs from http://localhost or the expected internal host
- Hunt browser proxy or EDR network telemetry for outbound connections to 61208/tcp originating from browser processes
- Alert on any Glances instance returning the Access-Control-Allow-Origin: * header on /api/4/* responses
Monitoring Recommendations
- Continuously inventory hosts running Glances and confirm the running version is 4.5.4 or later
- Monitor for new listeners on 61208/tcp exposed beyond loopback interfaces
- Track DNS and HTTP egress from workstations to identify exfiltration of telemetry harvested through the local API
How to Mitigate CVE-2026-34839
Immediate Actions Required
- Upgrade Glances to version 4.5.4 or later on every host running the web server
- Restrict the Glances web server to the loopback interface where remote access is not required
- Place Glances behind a reverse proxy that enforces authentication and a strict CORS allow-list
Patch Information
The maintainer fixed the issue in Glances 4.5.4 by tightening the CORS policy on the REST API. The upstream change is documented in the Glances patch commit fdfb977b and the GitHub Security Advisory GHSA-gfc2-9qmw-w7vh.
Workarounds
- Bind Glances to 127.0.0.1 and avoid exposing port 61208 to other interfaces until patched
- Front the service with a reverse proxy that overrides Access-Control-Allow-Origin with a specific trusted origin
- Disable the Glances web server (-w flag) on hosts that do not require it
# Configuration example: restrict Glances web server to loopback
glances -w --bind 127.0.0.1
# Verify the installed version is patched
pip show glances | grep -i version
# Expected: Version: 4.5.4 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
