{"id":"CVE-2026-68517","title":"Glances is an open-source system cross-platform monitoring tool","summary":"Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list conta…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwe":["CWE-942"],"vendor":"glances","product":"glances","affected":["glances < 4.5.6"],"patched":["glances 4.5.6"],"published":"2026-08-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68517","references":[{"url":"https://github.com/nicolargo/glances/commit/890858944ab9d03730ec6b1ba42d4015e6d85db5","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/releases/tag/v4.5.6","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-fp27-88fp-2phg","label":"security-advisories@github.com"},{"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-fp27-88fp-2phg","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-fp27-88fp-2phg"}],"tags":["nvd","ghsa","pip"],"epss":0.00325,"epssPercentile":0.25846,"aliases":["GHSA-fp27-88fp-2phg"],"ecosystem":"pip","ingestedAt":"2026-08-17T17:58:11.101Z","slug":"CVE-2026-68517","body":"## Overview\n\nGlances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-68517)\n\nAffected packages:\n\n- `glances < 4.5.6`\n\nPatched in:\n\n- `glances 4.5.6`\n\nSource: https://github.com/advisories/GHSA-fp27-88fp-2phg","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}