7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34839

CVE-2026-34839: Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (/api/4/*) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (Access-Control-Allow-Origin: *). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (/api/4/*) is also affected and exposes significantly more sensitive data. Version 4.5.4 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34839

CVE-2026-34839:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Glances	pip	< 4.5.4	4.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-34839, is a Cross-Origin Information Disclosure in Glances caused by a permissive CORS policy on its unauthenticated REST API. This allows any website to access sensitive system information from a user running Glances in web mode.

The analysis of the provided patch fdfb977b1d91b5e410bc06c4e19f8bedb0005ce9 pinpoints the vulnerable area of the codebase. The patch modifies the _router method within the GlancesRestfulApi class in glances/outputs/glances_restful_api.py. This function is responsible for setting up the web server's routing and middleware.

The patch introduces a warning when the server is run without a password and with the default permissive CORS setting (cors_origins = ["*"]). This indicates that the _router function is where the application's security posture regarding CORS is determined. The vulnerability is not a flaw in a specific data-processing function but rather a configuration issue established during the server's initialization, which is handled by _router. Therefore, GlancesRestfulApi._router is the key function that would be involved in the setup of the vulnerable state, making it a critical indicator for this vulnerability.

Vulnerable functions

GlancesRestfulApi._router

glances/outputs/glances_restful_api.py

The `_router` function in the `GlancesRestfulApi` class is responsible for configuring the REST API endpoints and their properties, including Cross-Origin Resource Sharing (CORS) settings. The vulnerability stems from a permissive default CORS policy (`Access-Control-Allow-Origin: *`), which allows any website to make requests to the Glances API and read the responses. The provided patch adds a warning within this function to alert users about this insecure default configuration, directly pointing to this function as the place where the security policy is handled. While this function itself does not process the malicious request, it configures the environment that makes the information disclosure possible.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.