8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32610

CVE-2026-32610: Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets allow_origins=["*"] combined with allow_credentials=True. When both of these options are enabled together, Starlette's CORSMiddleware reflects the requesting Origin header value in the Access-Control-Allow-Origin response header instead of returning the literal * wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance. Version 4.5.2 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32610

CVE-2026-32610:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Glances	pip	< 4.5.2	4.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a result of an insecure default CORS (Cross-Origin Resource Sharing) configuration in the Glances REST API server. The analysis of the provided patch commit 4465169b71d93991f1e49740fe02428291099832 confirms this. The vulnerable code is located in the __init__ method of the GlancesRestfulApi class in the file glances/outputs/glances_restful_api.py.

Previously, the CORSMiddleware was configured with allow_origins defaulting to ["*"] (all origins) and allow_credentials defaulting to True. While browsers typically block credentialed requests to a wildcard origin, the Starlette framework (used by FastAPI) has a feature that reflects the requesting Origin header in the Access-Control-Allow-Origin response header. This bypasses the browser's protection and allows any malicious website to make requests to the Glances API on behalf of an authenticated user, leading to the exfiltration of sensitive data.

The patch addresses this by changing the default value of cors_credentials to False and adding a specific check to prevent the combination of allow_origins=["*"] and allow_credentials=True. The GlancesRestfulApi.__init__ function is the entry point where this misconfiguration is applied, making it the vulnerable function. During runtime, this function is responsible for setting up the web server's middleware, and its flawed logic is what introduces the security risk.

Vulnerable functions

GlancesRestfulApi.__init__

glances/outputs/glances_restful_api.py

The vulnerability lies in the constructor of the `GlancesRestfulApi` class. This function initializes the FastAPI application and its middleware. The insecure default configuration for the `CORSMiddleware` is set here, with `allow_origins` defaulting to `["*"]` and `allow_credentials` defaulting to `True`. This combination allows any website to make credentialed cross-origin requests to the Glances API, enabling the theft of sensitive system information.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.