CVE-2026-46608: nicolargo Glances CORS wildcard fallback in XML-RPC server

CVE-2026-46608 · Severity: high · CVSS 7.4 · Published 2026-06-25

Glances is a system monitoring tool used to track performance metrics like CPU, memory, and running processes. A security flaw in its server mode allows malicious websites to bypass access restrictions and steal sensitive system data if the administrator tries to set up multiple authorized dashboards. This could result in the exposure of hostnames, process lists, and potentially sensitive credentials contained in command-line arguments to unauthorized third parties.

Technologies: glances (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-46608 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46608 being exploited in the wild.
How severe is CVE-2026-46608?
High severity, with a CVSS score of 7.4, published 25 June 2026.
Which products and versions are affected?
glances (PyPI) < 4.5.5, ECOSYSTEM:introduced=0,fixed=4.5.5.
Is there a fix for CVE-2026-46608?
Yes. glances (PyPI): upgrade to 4.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46608 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46608?
Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • glances (PyPI): upgrade to 4.5.5 or later
    pip install "glances>=4.5.5"

Technical details

The Glances XML-RPC server (glances -s) fails to correctly handle multiple entries in the 'cors_origins' configuration. In `glances/server.py`, the implementation logic `self.cors_origin = cors_origins[0] if len(cors_origins) == 1 else "*"` causes any allowlist with two or more entries to collapse into a global wildcard. Because the server responds with 'Access-Control-Allow-Origin: *' for POST requests with 'text/plain' content types (CORS simple requests), a malicious webpage can use the fetch API to read the full system monitoring dataset (via the /RPC2 endpoint) from a victim's browser. This vulnerability is an incomplete fix for CVE-2026-33533 and is resolved in version 4.5.5.

Affected products

  • nicolargo Glances >= 4.5.3, < 4.5.5

Identifiers

  • CVE-2026-46608
  • GHSA-87qc-fj39-wccr
  • PYSEC-2026-2495

Timeline

  • 2026-06-13: patched: Version 4.5.5 released
  • 2026-06-25: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.