CVE-2026-68517

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6

Description The REST API server contains a flaw in its safety check designed to prevent the combination of cors credentials=True and an unrestricted CORS origin allowlist. The check in glances/outputs/glances restful api.py uses exact list equality instead of a membership test when evaluating the cors origins variable. Consequently, if a multi-entry origin configuration includes the wildcard * alongside other origins, the safety check is bypassed. Because the underlying CORSMiddleware treats any list containing * as allowing all origins, it reflects the request's Origin header and allows credentials. This enables an untrusted website to read authenticated monitoring data, such as full process lists including command-line arguments, usernames, and PIDs, by exploiting the browser's automatic replay of cached HTTP Basic Auth credentials.

Recommendations Update Glances to version 4.5.6. As a temporary workaround, avoid including the wildcard * in a multi-entry cors origins list when cors credentials is set to true.