CVE-2026-32633

🗓️ 18 Mar 2026 17:53:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 63 Views🌐 WEB

Glances before 4.5.2 exposes raw server objects with credentials via /api/4/serverslist in Central Browser mode.

Reporter	Title	Published	Views	Family All 30
attackerkb	CVE-2026-32633	18 Mar 202617:53	–	attackerkb
AlpineLinux	CVE-2026-32633	18 Mar 202617:53	–	alpinelinux
Information Security Automation	April Linux Patch Wednesday	22 Apr 202616:00	–	avleonov
BDU FSTEC	Glances Monitoring Tool Unauthenticated Access	24 May 202600:00	–	bdu_fstec
Circl	CVE-2026-32633	14 Mar 202614:52	–	circl
CNNVD	glances 安全漏洞	18 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`	18 Mar 202617:53	–	cvelist
Debian CVE	CVE-2026-32633	18 Mar 202617:53	–	debiancve
Github Security Blog	Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`	16 Mar 202616:35	–	github
Mend	CVE-2026-32633	18 Mar 202617:53	–	mend

NVD

Vulners

Node

nicolargo glancesRange<4.5.2

[
  {
    "vendor": "nicolargo",
    "product": "glances",
    "versions": [
      {
        "version": "< 4.5.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nicolargo/glances/releases/tag/v4.5.2
github	www.github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361e
github	www.github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8m

Parameter	Position	Path	Description	CWE
uri	nested	/api/4/serverslist	Endpoint returns server objects containing a uri field with embedded HTTP Basic credentials for downstream Glances servers; unauthenticated access may expose credentials.	CWE-200, CWE-522

17 Jun 2026 10:36Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.19.1

EPSS0.00636

SSVC