CVE-2026-32633

🗓️ 18 Mar 2026 17:53:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 11 Views🌐 WEB

Glances before 4.5.2 exposes raw server objects with credentials via /api/4/serverslist in Central Browser mode.

Reporter	Title	Published	Views	Family All 23
ATTACKERKB	CVE-2026-32633	18 Mar 202617:53	–	attackerkb
AlpineLinux	CVE-2026-32633	18 Mar 202617:53	–	alpinelinux
Information Security Automation	April Linux Patch Wednesday	22 Apr 202616:00	–	avleonov
Circl	CVE-2026-32633	14 Mar 202614:52	–	circl
CNNVD	glances 安全漏洞	18 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`	18 Mar 202617:53	–	cvelist
Debian CVE	CVE-2026-32633	18 Mar 202617:53	–	debiancve
Github Security Blog	Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`	16 Mar 202616:35	–	github
NVD	CVE-2026-32633	18 Mar 202618:16	–	nvd
OPENSUSE Linux	glances-common-4.5.2-1.1 on GA media (moderate)	25 Mar 202600:00	–	opensuse

NVD

Vulners

Node

nicolargo glancesRange<4.5.2

[
  {
    "vendor": "nicolargo",
    "product": "glances",
    "versions": [
      {
        "version": "< 4.5.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nicolargo/glances/commit/879ef8688ffa1630839549751d3c7ef9961d361e
github	www.github.com/nicolargo/glances/releases/tag/v4.5.2
github	www.github.com/nicolargo/glances/security/advisories/GHSA-r297-p3v4-wp8m

Parameter	Position	Path	Description	CWE
uri	nested	/api/4/serverslist	Endpoint returns server objects mutated in background, exposing a uri field with embedded credentials, leading to credential leakage when accessed without authentication.	CWE-200, CWE-522

19 Mar 2026 19:04Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

EPSS0.00472

SSVC