Most recent entries from all

BREW-glances-CVE-2026-68517 — Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin All…

2026-10-03T21:52:25.911522+00:00

Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.

CVE-2026-68517 — Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin All…

2026-10-03T21:52:25.911578+00:00

Affected: nicolargo glances

GHSA-fp27-88fp-2phg — Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin All…

2026-10-03T21:52:25.911610+00:00

Affected: PyPI: glances

### Summary Glances's REST API server includes a documented safety check intended to guarantee that `cors_credentials=True` can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality (`cors_origins == ["*"]`) instead of a membership test. Any multi-entry origin configuration that merely includes `"*"` alongside other origins (e.g. `cors_origins=*,https://trusted.example.com`) bypasses the check entirely, while Starlette's underlying `CORSMiddleware` still treats the presence of `"*"` anywhere in the list as "allow all origins" and reflects the request's actual `Origin` header together with `Access-Control-Allow-Credentials: true`. This allows any website to read a victim's authenticated Glances monitoring data — including full process lists with command-line arguments — by exploiting the browser's automatic replay of cached HTTP Basic Auth credentials in a cross-origin request.

### Details `glances/outputs/glances_restful_api.py:298`: ```python if cors_origins == ["*"] and cors_credentials: logger.warning(...) cors_credentials = False ``` The intended guarantee is documented in `glances/outputs/glances_stdout_api_restful_doc.py:247-260`: *"Setting cors_credentials=True with cors_origins=* is not allowed. Glances will automatically disable credentials and log a warning if this combination is detected."* The exact-equality comparison only matches when `cors_origins` is preci…