CVE-2026-34839

Katalog CVE

CVSS 6.5 · Medium EPSS 0,47%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada nicolargo glances. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (`/api/4/*`) is also affected and exposes significantly more sensitive data. Version 4.5.4 patches the issue.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-306: Missing Authentication for Critical Function
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nicolargo/glances/security/advisories/GHSA-gfc2-9qmw-w7vh exploit · advisory vendor
• https://github.com/nicolargo/glances/commit/fdfb977b1d91b5e410bc06c4e19f8bedb0005ce9 patch