CVE catalog

CVE-2026-32633

Severity: Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Mar 18, 2026, 5:53:11 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.49% · Oct 25, 2026

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	glances	sid	`4.5.8+dfsg-1`	fixed
Debian	glances	forky	`4.5.8+dfsg-1`	fixed
Debian	glances	trixie	`4.3.1+dfsg-1`	vulnerable
Debian	glances	bookworm	`3.3.1.1+dfsg-1`	vulnerable
Pip	Glances	Not reported	`4.5.2`	fixed
Cpe	glances	Not reported	Not reported	vulnerable
PyPI	glances	Not reported	`4.5.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	glances	source	sid	`4.5.2+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	glances	source	forky	`4.5.2+dfsg-1`	not yet assigned	Not reported	Not reported
Debian	glances	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	glances	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Pip	Glances	pip	Not reported	`4.5.2`	Not reported	Not reported	Not reported
PyPI	glances	PyPI	Not reported	`4.5.2`	Not reported	PYSEC-2026-343	Not reported

Notes

[trixie] glances: Minor issue [bookworm] glances: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[glances]Affected
Details (2)
- 3.3.1.1+dfsg-1 · all · bookworm
  Affected
  nvd · glances · debian · bookworm; nvd · glances · debian · 12
- 3.3.1.1+dfsg-1 · all · bookworm
  Affected
  nvd · glances · debian · bookworm; nvd · glances · debian · 12
[glances-doc]Affected
Source package: [glances]
Details (2)
- 3.3.1.1+dfsg-1 · all · bookworm
  Affected
  nvd · glances · debian · bookworm; nvd · glances · debian · 12
- 3.3.1.1+dfsg-1 · all · bookworm
  Affected
  nvd · glances · debian · bookworm; nvd · glances · debian · 12

[Debian 13 (Trixie)]

[glances]Affected
Details (2)
- 4.3.1+dfsg-1 · all · trixie
  Affected
  nvd · glances · debian · 13
- 4.3.1+dfsg-1 · all · trixie
  Affected
  nvd · glances · debian · 13
[glances-doc]Affected
Source package: [glances]
Details (2)
- 4.3.1+dfsg-1 · all · trixie
  Affected
  nvd · glances · debian · 13
- 4.3.1+dfsg-1 · all · trixie
  Affected
  nvd · glances · debian · 13

Observed: Oct 23, 2026, 10:40:21 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]