# CVE-2026-46608: nicolargo Glances CORS wildcard fallback in XML-RPC server

Source: https://junglewise.ai/threats/cve-2026-46608-nicolargo-glances-cors-wildcard-fallback-in-xml-rpc-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-46608 · Severity: high · CVSS 7.4 · Published 2026-06-25

Glances is a system monitoring tool used to track performance metrics like CPU, memory, and running processes. A security flaw in its server mode allows malicious websites to bypass access restrictions and steal sensitive system data if the administrator tries to set up multiple authorized dashboards. This could result in the exposure of hostnames, process lists, and potentially sensitive credentials contained in command-line arguments to unauthorized third parties.

Technologies: [glances (PyPI)](https://junglewise.ai/threats/technologies/glances). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-46608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46608 being exploited in the wild.

**How severe is CVE-2026-46608?** High severity, with a CVSS score of 7.4, published 25 June 2026.

**Which products and versions are affected?** glances (PyPI) < 4.5.5, ECOSYSTEM:introduced=0,fixed=4.5.5.

**Is there a fix for CVE-2026-46608?** Yes. glances (PyPI): upgrade to 4.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46608 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46608?** Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- glances (PyPI): upgrade to 4.5.5 or later

  ```sh
  pip install "glances>=4.5.5"
  ```


## Technical details

The Glances XML-RPC server (glances -s) fails to correctly handle multiple entries in the 'cors_origins' configuration. In `glances/server.py`, the implementation logic `self.cors_origin = cors_origins[0] if len(cors_origins) == 1 else "*"` causes any allowlist with two or more entries to collapse into a global wildcard. Because the server responds with 'Access-Control-Allow-Origin: *' for POST requests with 'text/plain' content types (CORS simple requests), a malicious webpage can use the fetch API to read the full system monitoring dataset (via the /RPC2 endpoint) from a victim's browser. This vulnerability is an incomplete fix for CVE-2026-33533 and is resolved in version 4.5.5.

## Affected products

- nicolargo Glances >= 4.5.3, < 4.5.5

## Identifiers

- CVE-2026-46608
- GHSA-87qc-fj39-wccr
- PYSEC-2026-2495

## Timeline

- 2026-06-13: patched: Version 4.5.5 released
- 2026-06-25: disclosed: NVD publication date

## References

- [https://github.com/nicolargo/glances/releases/tag/v4.5.5](https://github.com/nicolargo/glances/releases/tag/v4.5.5)
- [https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr](https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr)

## Related threats

- [Glances as_dict_secure credential leak in API config endpoint](https://junglewise.ai/threats/cve-2026-68520-glances-as-dict-secure-credential-leak-in-api-config-endpoint)
- [Glances incomplete fix in alert action command execution](https://junglewise.ai/threats/cve-2026-68519-glances-incomplete-fix-in-alert-action-command-execution)
- [Glances incomplete command injection sanitizer fix in nested stat values](https://junglewise.ai/threats/cve-2026-62982-glances-incomplete-command-injection-sanitizer-fix-in-nested-stat)
- [Glances command injection via cross-field shell-operator reconstruction](https://junglewise.ai/threats/cve-2026-68518-glances-command-injection-via-cross-field-shell-operator)
- [Glances REST API CORS credentials bypass via wildcard in multi-origin list](https://junglewise.ai/threats/cve-2026-68517-glances-rest-api-cors-credentials-bypass-via-wildcard-in-multi)