8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32634

CVE-2026-32634: Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

Summary

In Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global [passwords] default credential.

An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode.

Details

Dynamic server discovery keeps both a short name and a separate ip:

# glances/servers_list_dynamic.py:56-61
def add_server(self, name, ip, port, protocol='rpc'):
    new_server = {
        'key': name,
        'name': name.split(':')[0],  # Short name
        'ip': ip,  # IP address seen by the client
        'port': port,
        ...
        'type': 'DYNAMIC',
    }

The Zeroconf listener populates those fields directly from the service advertisement:

# glances/servers_list_dynamic.py:112-121
new_server_ip = socket.inet_ntoa(address)
new_server_port = info.port
...
self.servers.add_server(
    srv_name,
    new_server_ip,
    new_server_port,
    protocol=new_server_protocol,
)

However, the Central Browser connection logic ignores server['ip'] and instead uses the untrusted advertised server['name'] for both password lookup and the destination URI:

# glances/servers_list.py:119-130
def get_uri(self, server):
    if server['password'] != "":
        if server['status'] == 'PROTECTED':
            clear_password = self.password.get_password(server['name'])
            if clear_password is not None:
                server['password'] = self.password.get_hash(clear_password)
        uri = 'http://{}:{}@{}:{}'.format(
            server['username'],
            server['password'],
            server['name'],
            server['port'],
        )
    else:
        uri = 'http://{}:{}'.format(server['name'], server['port'])
    return uri

Miggo Vulnerability Database

→

CVE-2026-32634

CVE-2026-32634:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Glances	pip	< 4.5.2	4.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Glances' Central Browser mode with autodiscovery enabled. An attacker on the local network can advertise a fake Glances service using Zeroconf. The core of the vulnerability is that the Glances client trusts the service name advertised via Zeroconf, which is attacker-controlled. This untrusted service name is then used to construct connection URIs and to look up saved credentials.

The primary vulnerable function is GlancesServersList.get_uri, which builds the URI for connecting to a server. Before the patch, it used the server['name'] for both the hostname in the URI and as the key to retrieve a password from the password list. This means that when a dynamic server is discovered, the client would use the attacker-provided name to connect and authenticate, sending credentials to the attacker.

Aiding this is the GlancesPasswordList.get_password function, which has a fallback mechanism to a default password if a specific one isn't found. This makes it easier for an attacker to steal credentials, as they only need the victim to have a default password configured.

Similarly, the GlancesClientBrowser.__display_server function was also vulnerable as it directly fetched passwords using the untrusted server['name'].

The patch addresses this by introducing helper functions (_get_connect_host and _get_preconfigured_password) that differentiate between static and dynamic servers. For dynamic (Zeroconf-discovered) servers, the patched code now correctly uses the discovered IP address (server['ip']) for connections and, crucially, prevents the use of any pre-configured or default passwords, thus preventing the credential leak.

Vulnerable functions

GlancesServersList.get_uri

glances/servers_list.py

The function `get_uri` in `GlancesServersList` was vulnerable because it used the `server['name']` field, which can be controlled by an attacker via a malicious Zeroconf advertisement, to construct the connection URI and to look up passwords. This allowed an attacker to cause the Glances client to send credentials to an arbitrary server.

GlancesClientBrowser.__display_server

glances/client_browser.py

The `__display_server` function in `GlancesClientBrowser` was vulnerable because it directly called `self.servers_list.password.get_password(server['name'])` to retrieve a password for a server. When the server is a dynamically discovered one, `server['name']` can be controlled by an attacker, leading to credential leakage.

GlancesPasswordList.get_password

glances/password_list.py

The `get_password` function in `GlancesPasswordList` is part of the vulnerability chain. While not patched directly, its behavior of falling back to a 'default' password when a specific host password is not found is a key element that makes the credential leakage more impactful. An attacker can trigger a password lookup for a fake host, causing this function to return the default password, which is then sent to the attacker's server. The fix was applied in the calling functions to avoid calling this function with untrusted input for dynamic servers.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

cd D:\bugcrowd\glances\repo @' import importlib.util import sys import types from pathlib import Path pkg = types.ModuleType('glances') pkg.__apiversion__ = '4' sys.modules['glances'] = pkg client_mod = types.ModuleType('glances.client') class GlancesClientTransport: pass client_mod.GlancesClientTransport = GlancesClientTransport sys.modules['glances.client'] = client_mod globals_mod = types.ModuleType('glances.globals') globals_mod.json_loads = lambda x: x sys.modules['glances.globals'] = globals_mod logger_mod = types.ModuleType('glances.logger') logger_mod.logger = types.SimpleNamespace( debug=lambda *a, **k: None, warning=lambda *a, **k: None, info=lambda *a, **k: None, error=lambda *a, **k: None, ) sys.modules['glances.logger'] = logger_mod password_list_mod = types.ModuleType('glances.password_list') class GlancesPasswordList: pass password_list_mod.GlancesPasswordList = GlancesPasswordList sys.modules['glances.password_list'] = password_list_mod dynamic_mod = types.ModuleType('glances.servers_list_dynamic') class GlancesAutoDiscoverServer: pass dynamic_mod.GlancesAutoDiscoverServer = GlancesAutoDiscoverServer sys.modules['glances.servers_list_dynamic'] = dynamic_mod static_mod = types.ModuleType('glances.servers_list_static') class GlancesStaticServer: pass static_mod.GlancesStaticServer = GlancesStaticServer sys.modules['glances.servers_list_static'] = static_mod spec = importlib.util.spec_from_file_location('tested_servers_list', Path('glances/servers_list.py')) mod = importlib.util.module_from_spec(spec) spec.loader.exec_module(mod) GlancesServersList = mod.GlancesServersList class FakePassword: def get_password(self, host=None): print(f'lookup:{host}') return 'defaultpassword' def get_hash(self, password): return f'hash({password})' sl = GlancesServersList.__new__(GlancesServersList) sl.password = FakePassword() server = { 'name': 'trusted-host', 'ip': '203.0.113.77', 'port': 61209, 'username': 'glances', 'password': None, 'status': 'PROTECTED', 'type': 'DYNAMIC', } print(sl.get_uri(server)) print(server) '@ | python -

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-32634: Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

Summary

Details

CVE-2026-32634:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

8.1

8.1

CVE-2026-32634: Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

Summary

Details

Exploit Flow

PoC

Step 1: Verified local logic proof

Step 2: Live network reproduction

Impact

Recommended Fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI