VulnerabilityAnalyzed

CVE-2026-32596

Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any…

HIGH 8.7EPSS 1.55%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.55% probability · 74th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: nicolargo/glances
Source: security-advisories@github.com

References

https://github.com/nicolargo/glances/commit/208d876118fea5758970f33fd7474908bd403d25Patch
https://github.com/nicolargo/glances/releases/tag/v4.5.2Product, Release Notes
https://github.com/nicolargo/glances/security/advisories/GHSA-wvxv-4j8q-4wjqExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.