Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-34839— Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

Quick assessment

Affected
nicolargo glances
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

glances是Nicolas Hennion个人开发者的一款系统监测工具。 glances 4.5.4之前版本存在安全漏洞，该漏洞源于REST API未经验证且允许跨域请求，可能导致恶意网站读取敏感系统信息，造成跨域数据渗漏。

AI Predicted 5.3 Difficulty: Easy EPSS 0.47% · P39

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-34839

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
Source: CVE Program / CVE List V5
Vulnerability Description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (`/api/4/*`) is also affected and exposes significantly more sensitive data. Version 4.5.4 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
glances 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
glances是Nicolas Hennion个人开发者的一款系统监测工具。 glances 4.5.4之前版本存在安全漏洞，该漏洞源于REST API未经验证且允许跨域请求，可能导致恶意网站读取敏感系统信息，造成跨域数据渗漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
nicolargo glances < 4.5.4 -

II. Public POCs for CVE-2026-34839

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-34839

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-34839 (1)

Same Patch Batch · nicolargo · 2026-04-20 · 3 CVEs total

CVE-2026-35588 6.3 MEDIUM Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
CVE-2026-35587 Glances IP Plugin has SSRF via public_api that leads to credential leakage

IV. Related Vulnerabilities

Same product: glances
Same vendor: nicolargo
Same weakness: CWE-200

V. Comments for CVE-2026-34839

No comments yet

Leave a comment