Q: Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-200 (Information Exposure). 🔍 **Flaw**: The API endpoint fails to sanitize server objects, exposing sensitive authentication data that should remain hidden from unauthenticated users.

Q: Who is affected? (Versions/Components)

📦 **Vendor**: Nicolargo. 📦 **Product**: Glances. ⚠️ **Affected**: Versions **prior to 4.5.2**. ✅ **Fixed**: Version 4.5.2 and later.

Q: What can hackers do? (Privileges/Data)

🕵️ **Action**: Retrieve embedded HTTP Basic Auth credentials. 🔓 **Impact**: High Confidentiality & Integrity impact. Hackers gain access to downstream servers using stolen credentials without needing direct access.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Auth**: None required (PR:N). 🌐 **Access**: Network accessible (AV:N). 🚀 **Threshold**: **LOW**. Any network user can trigger the leak via the API endpoint without logging in.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exp**: No PoC provided in data. 📉 **Risk**: While no wild exploit exists yet, the low barrier to entry makes it highly susceptible to rapid automation by threat actors.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for Glances Central Browser mode. 📡 **Test**: Request `GET /api/4/serverslist` without auth. 👀 **Verify**: Inspect JSON response for embedded `username`/`password` fields in server objects.

Q: What if no patch? (Workaround)

🛑 **Workaround**: Disable Central Browser mode if not needed. 🚫 **Network**: Restrict access to the Glances API port via firewall rules. 🧹 **Audit**: Regularly rotate credentials for downstream servers.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: **HIGH**. CVSS Score indicates High Confidentiality/Integrity impact with no auth required. Immediate patching or mitigation is strongly recommended to prevent credential theft.

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: Glances < 4.5.2 leaks embedded HTTP basic credentials via `/api/4/serverslist` in Central Browser mode.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **CWE**: CWE-200 (Information Exposure). 🔍 **Flaw**: The API endpoint fails to sanitize server objects, exposing sensitive authentication data that should remain hidden from unauthenticated users.

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Vendor**: Nicolargo. 📦 **Product**: Glances. ⚠️ **Affected**: Versions **prior to 4.5.2**. ✅ **Fixed**: Version 4.5.2 and later.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

🕵️ **Action**: Retrieve embedded HTTP Basic Auth credentials. 🔓 **Impact**: High Confidentiality & Integrity impact. Hackers gain access to downstream servers using stolen credentials without needing direct access.

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

🔓 **Auth**: None required (PR:N). 🌐 **Access**: Network accessible (AV:N). 🚀 **Threshold**: **LOW**. Any network user can trigger the leak via the API endpoint without logging in.

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🚫 **Public Exp**: No PoC provided in data. 📉 **Risk**: While no wild exploit exists yet, the low barrier to entry makes it highly susceptible to rapid automation by threat actors.

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Check**: Scan for Glances Central Browser mode. 📡 **Test**: Request `GET /api/4/serverslist` without auth. 👀 **Verify**: Inspect JSON response for embedded `username`/`password` fields in server objects.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Patch**: Yes! Upgrade to **Glances 4.5.2**.…

Question 9

What if no patch? (Workaround)

Accepted Answer

🛑 **Workaround**: Disable Central Browser mode if not needed. 🚫 **Network**: Restrict access to the Glances API port via firewall rules. 🧹 **Audit**: Regularly rotate credentials for downstream servers.

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Priority**: **HIGH**. CVSS Score indicates High Confidentiality/Integrity impact with no auth required. Immediate patching or mitigation is strongly recommended to prevent credential theft.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-32633 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring