PYSEC-2026-2495 Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Summary The Glances XML-RPC server glances -s introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE 2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: whenever corsorigins contains more than one entry. An operator who configur...

GHSA-87QC-FJ39-WCCR Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Summary The Glances XML-RPC server glances -s introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE 2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: whenever corsorigins contains more than one entry. An operator who configur...

CVE-2026-33533

creationtimestamp| type| source ---|---|--- 2026-03-29 15:05:01+00:00| published-proof-of-concept| https://github.com/nicolargo/glances/security/advisories/GHSA-7p93-6934-f4q7 2026-04-02 17:37:18+00:00| seen| Telegram/asfs2UkHDA2dEAWxK7wNvn0OefGesF-RFz1ocNui3XpVnY...