Glances CVE-2026-68517

Three simultaneous conditions must hold: (1) The Glances REST API web server must be running and network-accessible to the attacker's origin. (2) The operator must have configured a non-default combination in glances.conf: cors_credentials=true AND a cors_origins value that is a multi-entry list explicitly containing '*' alongside at least one other origin - for example, cors_origins=*,https://trusted.example.com. The single-entry wildcard configuration (cors_origins=*) is NOT vulnerable, as it correctly triggers the old guard. (3) A victim user must have cached HTTP Basic Auth credentials for the Glances instance in their browser and must actively visit an attacker-controlled webpage during that session. Exploitation is strictly limited to confidentiality - read-only exfiltration of REST API data. No integrity or availability impact is possible via this vector. The misconfigured cors_credentials+wildcard combination is not present in default Glances installations.

The NVD-assigned CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects unauthenticated network access with user interaction required and high confidentiality impact, which is directionally correct. However, AC:L may overstate exploitability: the vulnerability only manifests when an operator has deliberately configured a non-default combination of cors_credentials=True and a multi-entry cors_origins list containing the wildcard - a specific misconfiguration that is atypical and would not be present in default Glances deployments. A case for AC:H exists on these grounds. Real-world risk is further constrained by the browser-based attack model: a victim must visit an attacker-controlled page while holding cached HTTP Basic Auth credentials to the Glances instance. No CISA KEV listing means confirmed mass exploitation is absent. EPSS data was not provided; given the narrow configuration prerequisite and the niche deployment footprint of Glances, EPSS would likely be low. The public GHSA advisory contains a working PoC (curl-based demonstration), which slightly elevates opportunistic risk but does not constitute active exploitation evidence. Impact is strictly read-only data exfiltration - no integrity or availability risk.

An attacker registers a malicious domain and embeds a JavaScript payload that issues a credentialed cross-origin fetch to the victim's Glances REST API endpoint (e.g., http://monitor.internal:61208/api/4/processlist). When a Glances user who has previously authenticated via HTTP Basic Auth visits the attacker's page in the same browser, the browser automatically includes cached credentials in the cross-origin request; because Starlette reflects the wildcard-origin configuration with Access-Control-Allow-Credentials: true, the browser returns the full API response to the attacker's script, exposing process lists, system stats, and command-line arguments. A proof-of-concept demonstrating the credential reflection behavior is publicly available in the GHSA advisory.