CVE-2026-34839Medium· 6.5▾ Sunlit

Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Apr 21, 2026

Updated

Jul 13, 2026

CVSS

6.5

Vendor

glances

Product

glances

CWE

—

Depth score

36 · Low

EPSS

0.41% · p35

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 13.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 83 days

Apr 21, 2026Published
Disclosed via OSV
Jul 13, 2026Record revised
Last analysed / modified upstream
Jul 13, 2026EPSS first tracked
0.4%

glances #osv #pip

Affected

glances < 4.5.4

Patched in

glances 4.5.4

Full technical detail▾

Overview

Summary

The Glances web server exposes a REST API (/api/4/*) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (Access-Control-Allow-Origin: *).

This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration.

While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (/api/4/*) is also affected and exposes significantly more sensitive data.

Details

When Glances is started in web mode (e.g., glances -w -B 0.0.0.0), it exposes a REST API endpoint at: http://<host>:61208/api/4/all The server responds with: Access-Control-Allow-Origin: *

This allows any origin to perform cross-origin requests and read responses.

The /api/4/all endpoint returns extensive system information, including:

Process list (processlist)
System details (hostname, OS, CPU info)
Memory and disk usage
Network interfaces and IP address
Running services and metrics Because no authentication is required by default, this data is accessible to any web page.

PoC

Start Glances: glances -w -B 0.0.0.0
Create a malicious HTML file:

<!DOCTYPE html>
<html>
<body>
<script>
fetch("http://<victim-ip>:61208/api/4/all")
  .then(r => r.json())
  .then(data => {
    console.log("DATA:", data);
  });
</script>
</body>
</html>

Open the file in a browser while Glances is running.
Observe that the browser successfully retrieves sensitive system information from the API. This works cross-origin (e.g., from file:// or attacker-controlled domains).

Impact

A remote attacker can host a malicious website that, when visited by a victim running Glances, can:

Read sensitive system information
Enumerate running processes
Identify network configuration and IP addresses
Fingerprint the host system

This requires no authentication and no user interaction beyond visiting a web page. This represents a cross-origin information disclosure vulnerability and can aid further attacks such as reconnaissance or targeted exploitation.

Affected packages

glances < 4.5.4

Remediation

Upgrade to a patched release:

glances 4.5.4

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip

Overview

Summary

This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration.

While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (/api/4/*) is also affected and exposes significantly more sensitive data.

Details

When Glances is started in web mode (e.g., glances -w -B 0.0.0.0), it exposes a REST API endpoint at: http://<host>:61208/api/4/all The server responds with: Access-Control-Allow-Origin: *

This allows any origin to perform cross-origin requests and read responses.

The /api/4/all endpoint returns extensive system information, including:

Process list (processlist)

System details (hostname, OS, CPU info)

Memory and disk usage

Network interfaces and IP address

Running services and metrics Because no authentication is required by default, this data is accessible to any web page.

PoC

Start Glances: glances -w -B 0.0.0.0

Create a malicious HTML file:

<!DOCTYPE html> <html> <body> <script> fetch("http://<victim-ip>:61208/api/4/all") .then(r => r.json()) .then(data => { console.log("DATA:", data); }); </script> </body> </html>

Open the file in a browser while Glances is running.

Observe that the browser successfully retrieves sensitive system information from the API. This works cross-origin (e.g., from file:// or attacker-controlled domains).

Impact

A remote attacker can host a malicious website that, when visited by a victim running Glances, can:

Read sensitive system information

Enumerate running processes

Identify network configuration and IP addresses

Fingerprint the host system