CVE-2026-32633Disclosure(nicolargo / glances)

LOWCVSS 9.1 · CRITICAL

Signal is active with 7 mentions in latest observed window

Immediate actions

Patch nicolargo glances systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.

nicolargo CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361e

Exploit / PoC references

Other references

https://github.com/nicolargo/glances/releases/tag/v4.5.2

Weakness type (CWE)

CWE-200CWE-522

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

glances

Threat summary

Patch or workaround signal is available
7 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 7 signals
Disclosure: 7 classified signals
7 total mentions across 1 day

Affected systems

Vendors

nicolargo

Products

glances

Deep dive

Activity timeline7 mentions / 1d

Signal classification1 categories

Disclosure

7100.0%

Referenced assets8 URLs

By indicator

Full discourse7 posts

The Hacker Wire@TheHackerWire203d
Disclosure
🔴 CVE-2026-32633 - Critical Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `Glance... https://www.thehackerwire.com/vulnerability/CVE-2026-32633/ https://t.co/2mtZLHHub4
Post summary
The text announces CVE-2026-32633 and describes a specific API behavior that exposes raw server objects, but it does not provide exploitation details, a PoC, or patch information.
0001051
138 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash203d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-32633 - Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` Intel Report: https://ift.tt/3RlnwPk
Post summary
The tweet announces CVE-2026-32633, identifying its impact on Glances' Browser API, but provides no PoC, exploit code, patch, or evidence of active exploitation.
0000034
335 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds203d
Disclosure
CVE-2026-32633 Unauthenticated Credential Exposure in Glances System Monitoring ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32633 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet lists CVE‑2026‑32633 as an unauthenticated credential-exposure flaw in Glances, referencing a Vulmon details page but providing no PoC, exploit, patch, or evidence of active use.
0000053
4.0K followersView on X
CVE@CVEnew203d
Disclosure
CVE-2026-32633 Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server… https://www.cve.org/CVERecord?id=CVE-2026-32633
Post summary
The statement announces CVE-2026-32633, noting that Glances before version 4.5.2 exposes raw server information via the `/api/4/serverslist` endpoint; no PoC, exploit, patch or active exploitation details are provided.
0000073
56.8K followersView on X
CVEFind.com@CveFindCom203d
Disclosure
[CVE-2026-32633: CRITICAL] Before Glances version 4.5.2, its Central Browser mode had a vulnerability where credentials could be exposed. Update to 4.5.2 to fix this security flaw in Glances.#cve,CVE-2026-32633,#cybersecurity https://cvefind.com/CVE-2026-32633
Post summary
A critical credential‑exposure vulnerability exists in Glances versions before 4.5.2, and updating to version 4.5.2 will address the flaw.
0000041
603 followersView on X
0day Signal@0dayPublishing203d
Disclosure
🚨 CVE-2026-32633: Glances's Browser API Exposes Re... Unauthenticated credential leakage through mutated server objects - classic case of in-memory state pollution exposing ... https://zerodaysignal.com/vulnerability/CVE-2026-32633 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2026‑32633, highlighting credential leakage via mutated server objects and in‑memory state pollution, but offers no PoC, exploit details, patch information, or evidence of active exploitation.
0000054
155 followersView on X
PulsePatch.io@pulsepatchio204d
Disclosure
Credential exposure in `Glances` via its Browser API (`/api/4/serverslist`) allows for reuse of downstream credentials. CVE-2026-32633. #Glances #APISecurity #InfoSec https://www.pulsepatch.io/posts/cve-2026-32633-glances-browser-api-credential-exposure
Post summary
The post announces CVE-2026-32633, detailing a credential exposure issue in Glances’ Browser API, with a link to an external write‑up but no PoC, exploit, or mitigation information.
0000025
1 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nicolargo	glances	-	-	-

Explore more

Back to dashboard nicolargo CVEs glances vulnerabilities

What researchers are saying

CVE-2026-32633

The Hacker Wire@TheHackerWireDisclosure

The text announces CVE-2026-32633 and describes a specific API behavior that exposes raw server objects, but it does not provide exploitation details, a PoC, or patch information.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The tweet announces CVE-2026-32633, identifying its impact on Glances' Browser API, but provides no PoC, exploit code, patch, or evidence of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet lists CVE‑2026‑32633 as an unauthenticated credential-exposure flaw in Glances, referencing a Vulmon details page but providing no PoC, exploit, patch, or evidence of active use.

CVE@CVEnewDisclosure

The statement announces CVE-2026-32633, noting that Glances before version 4.5.2 exposes raw server information via the `/api/4/serverslist` endpoint; no PoC, exploit, patch or active exploitation details are provided.

CVEFind.com@CveFindComDisclosure

A critical credential‑exposure vulnerability exists in Glances versions before 4.5.2, and updating to version 4.5.2 will address the flaw.

0day Signal@0dayPublishingDisclosure

The tweet announces CVE‑2026‑32633, highlighting credential leakage via mutated server objects and in‑memory state pollution, but offers no PoC, exploit details, patch information, or evidence of active exploitation.

PulsePatch.io@pulsepatchioDisclosure

The post announces CVE-2026-32633, detailing a credential exposure issue in Glances’ Browser API, with a link to an external write‑up but no PoC, exploit, or mitigation information.