CVE-2026-32633: Glances Package Exposes Reusable Downstream Credentials via API Endpoint
Summary
CVE-2026-32633: Glances's Browser API Exposes Reusable Downstream Credentials via /api/4/serverslist. Affects glances versions < 4.5.2. Fixed in 4.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Glances is a real-time monitoring tool that provides a comprehensive overview of system performance metrics. It allows users to monitor various aspects of their systems, including CPU, memory, disk usage, and network activity. The package is designed for both local and remote monitoring, making it a versatile tool for system administrators. However, a critical vulnerability has been identified in its Browser API, which can expose sensitive credentials if not properly secured.
Vulnerability Detail
In Central Browser mode, the '/api/4/serverslist' endpoint of Glances returns raw server objects that may contain a 'uri' field with embedded HTTP Basic credentials for downstream Glances servers. This occurs when the front Glances Browser/API instance is started without the '--password' option, making the endpoint completely unauthenticated. Any user on the network can access this API and retrieve sensitive credentials for protected downstream servers, leading to potential unauthorized access and credential replay attacks.
How To Fix
Minimum fixed version
4.5.2
This is the first release that contains the fix.
pip install --upgrade "glances==4.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize the API response to exclude sensitive fields. Modify the '_api_servers_list' function in 'glances/outputs/glances_restful_api.py' to strip out the 'uri' and 'password' fields before returning the server list. Here is an example of how to implement this:
# glances/outputs/glances_restful_api.py
def _sanitize_server(self, server):
safe = dict(server)
safe.pop('password', None)
safe.pop('uri', None)
return safe
def _api_servers_list(self):
self.__update_servers_list()
servers = self.servers_list.get_servers_list() if self.servers_list else []
return GlancesJSONResponse([self._sanitize_server(server) for server in servers])
Conclusion
The vulnerability CVE-2026-32633 in the Glances package poses a significant risk by exposing sensitive credentials through an unauthenticated API endpoint. It is crucial for users to update to the latest version and implement proper authentication to safeguard their systems.
See every vulnerability recorded for glances →
FAQ
CVE-2026-32633 is a vulnerability in the Glances package that allows unauthorized users to access reusable credentials for downstream servers via an unauthenticated API endpoint.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to downstream Glances servers, credential replay attacks, and a wide-reaching impact on the entire monitored fleet.
Ensure that you start the Glances Browser/API instance with the '--password' option and update to the latest patched version (4.5.2 or later) to mitigate the risk.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for glances.
