CVE-2026-35587: Nicolargo Glances SSRF Vulnerability

CVE-2026-35587 Overview

CVE-2026-35587 is a Server-Side Request Forgery (SSRF) vulnerability affecting Glances, a popular open-source cross-platform system monitoring tool. The vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter. Prior to version 4.5.4, the public_api value is used directly in outbound HTTP requests without any scheme restriction or hostname/IP validation, allowing attackers who can modify the Glances configuration to force the application to send requests to arbitrary internal or external endpoints.

Critical Impact

When public_username and public_password are configured, Glances automatically includes these credentials in the Authorization: Basic header, resulting in credential leakage to attacker-controlled servers. This vulnerability enables access to internal network services, retrieval of sensitive data from cloud metadata endpoints, and exfiltration of credentials via outbound HTTP requests.

Affected Products

• Nicolargo Glances versions prior to 4.5.4
• Systems using the Glances IP plugin with public_api configuration
• Deployments with public_username and public_password configured

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-35587 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-35587

Vulnerability Analysis

This SSRF vulnerability in Glances stems from the IP plugin's handling of the public_api configuration parameter. The parameter value is passed directly to the HTTP client (urlopen_auth) without any validation, allowing unrestricted outbound connections to arbitrary endpoints. This design flaw enables attackers with configuration access to pivot through the Glances application to reach otherwise inaccessible internal services or exfiltrate sensitive credentials to external servers.

The vulnerability is particularly severe in cloud environments where metadata endpoints (such as AWS IMDSv1 at http://169.254.169.254) can be targeted to retrieve instance credentials and other sensitive information. The automatic inclusion of configured credentials in HTTP Basic Authentication headers amplifies the risk by enabling credential theft.

Root Cause

The root cause is the absence of input validation and URL scheme restrictions on the public_api configuration parameter in the Glances IP plugin. The implementation directly passes user-controlled configuration values to the urlopen_auth HTTP client function without validating the target URL scheme, hostname, or IP address. This allows arbitrary destinations including internal network addresses, localhost, and cloud metadata endpoints.

Attack Vector

The attack vector is network-based and requires the attacker to have the ability to modify the Glances configuration file. Once configuration access is obtained, the attacker can set the public_api parameter to point to internal services (cloud metadata endpoints, internal APIs, or administrative interfaces) or to an attacker-controlled server to capture credentials. The attack requires no user interaction once the malicious configuration is in place.

The following patch demonstrates the security fix implemented in version 4.5.4:

 """IP plugin."""
 
 import threading
+from urllib.parse import urlparse
+from urllib.request import Request, urlopen
 
 from glances.globals import get_ip_address, json_loads, urlopen_auth
 from glances.logger import logger

Source: GitHub Commit d6808be66728956477cc4b544bab1acd71ac65fb

The patch adds URL parsing capabilities (urlparse) to enable proper validation of the public_api parameter before making outbound requests.

Detection Methods for CVE-2026-35587

Indicators of Compromise

• Unexpected outbound HTTP requests from Glances instances to internal IP ranges (e.g., 169.254.169.254, 10.x.x.x, 192.168.x.x)
• Glances configuration files modified with unusual public_api values pointing to non-standard endpoints
• HTTP requests containing Basic Authentication headers to untrusted external servers originating from Glances processes
• Log entries showing connections to cloud metadata endpoints from the Glances application

Detection Strategies

• Monitor network traffic from Glances instances for connections to internal IP ranges, localhost, or known cloud metadata endpoints
• Implement file integrity monitoring on Glances configuration files to detect unauthorized modifications to public_api settings
• Deploy network segmentation rules to restrict outbound connections from monitoring tools to approved endpoints only
• Review authentication logs for unexpected credential usage patterns originating from Glances servers

Monitoring Recommendations

• Configure SIEM alerts for outbound connections from Glances processes to private IP address ranges
• Implement DNS logging to detect attempts to resolve internal hostnames through the Glances application
• Monitor for HTTP Basic Authentication headers in outbound traffic from monitoring infrastructure
• Set up configuration file change alerts using endpoint detection and response (EDR) solutions

How to Mitigate CVE-2026-35587

Immediate Actions Required

• Upgrade Glances to version 4.5.4 or later immediately
• Audit all Glances configuration files for suspicious public_api values
• Rotate any credentials configured in public_username and public_password fields as a precaution
• Implement network segmentation to restrict outbound connections from Glances instances

Patch Information

The vulnerability has been patched in Glances version 4.5.4. The fix introduces proper URL validation using urlparse to restrict the public_api parameter to safe destinations. Organizations should update to the patched version as soon as possible.

For more details, refer to the GitHub Security Advisory GHSA-g5pq-48mj-jvw8 and the security patch commit.

Workarounds

• Restrict network access for Glances instances using firewall rules to prevent connections to internal networks and metadata endpoints
• Remove or disable the public_api, public_username, and public_password configuration options if not required
• Implement strict access controls on Glances configuration files to prevent unauthorized modifications
• Deploy the IMDSv2 requirement on AWS instances to mitigate cloud metadata endpoint exploitation

# Example: Restrict Glances outbound connections with iptables
# Block access to cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner glances -j DROP

# Block access to private IP ranges from Glances
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner glances -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner glances -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner glances -j DROP