nicolargo glances up to 4.5.4 permissive list of allowed inputs

Summaryinfo

A vulnerability identified as problematic has been detected in nicolargo glances up to 4.5.4. This affects an unknown part. The manipulation leads to permissive list of allowed inputs. This vulnerability is documented as CVE-2026-46608. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in nicolargo glances up to 4.5.4 and classified as problematic. This issue affects some unknown functionality. The manipulation with an unknown input leads to a permissive list of allowed inputs vulnerability. Using CWE to declare the problem leads to CWE-183. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. Impacted is confidentiality. The summary by CVE is:

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE-2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: * whenever cors_origins contains more than one entry. An operator who configures an explicit two-entry allowlist (e.g. two internal dashboard origins) intending to restrict browser access instead receives the unrestricted wildcard. A malicious web page served from any origin can issue a CORS simple request to /RPC2 and read the full system monitoring dataset without the victim's knowledge. This vulnerability is fixed in 4.5.5.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-46608 since 05/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.5.5 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• nicolargo

Name

• glances

Version

• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4

Website

• Product: https://github.com/nicolargo/glances/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion