https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:16:23 +0000 https://cve.radiocsirt.org/vuln/brew-glances-cve-2026-68517 <p><strong>Affected:</strong> Homebrew: glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.</p> <p><strong>Affected:</strong> Homebrew: glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.</p> https://cve.radiocsirt.org/vuln/brew-glances-cve-2026-68517 https://cve.radiocsirt.org/vuln/euvd-2026-354995 EUVD-2026-354995 https://cve.radiocsirt.org/vuln/euvd-2026-354995 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68517 <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68517 https://cve.radiocsirt.org/vuln/ghsa-fp27-88fp-2phg <p><strong>Affected:</strong> PyPI: glances</p> <p>### Summary Glances&#39;s REST API server includes a documented safety check intended to guarantee that `cors_credentials=True` can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality (`cors_origins == [&#34;*&#34;]`) instead of a membership test. Any multi-entry origin configuration that merely includes `&#34;*&#34;` alongside other origins (e.g. `cors_origins=*,https://trusted.example.com`) bypasses the check entirely, while Starlette&#39;s underlying `CORSMiddleware` still treats the presence of `&#34;*&#34;` anywhere in the list as &#34;allow all origins&#34; and reflects the request&#39;s actual `Origin` header together with `Access-Control-Allow-Credentials: true`. This allows any website to read a victim&#39;s authenticated Glances monitoring data — including full process lists with command-line arguments — by exploiting the browser&#39;s automatic replay of cached HTTP Basic Auth credentials in a cross-origin request.</p> <p>### Details `glances/outputs/glances_restful_api.py:298`: ```python if cors_origins == [&#34;*&#34;] and cors_credentials: logger.warning(...) cors_credentials = False ``` The intended guarantee is documented in `glances/outputs/glances_stdout_api_restful_doc.py:247-260`: *&#34;Setting cors_credentials=True with cors_origins=* is not allowed. Glances will automatically disable credentials and log a warning if this combination is detected.&#34;* The exact-equality comparison only matches when `cors_origins` is preci…</p> <p><strong>Affected:</strong> PyPI: glances</p> <p>### Summary Glances&#39;s REST API server includes a documented safety check intended to guarantee that `cors_credentials=True` can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality (`cors_origins == [&#34;*&#34;]`) instead of a membership test. Any multi-entry origin configuration that merely includes `&#34;*&#34;` alongside other origins (e.g. `cors_origins=*,https://trusted.example.com`) bypasses the check entirely, while Starlette&#39;s underlying `CORSMiddleware` still treats the presence of `&#34;*&#34;` anywhere in the list as &#34;allow all origins&#34; and reflects the request&#39;s actual `Origin` header together with `Access-Control-Allow-Credentials: true`. This allows any website to read a victim&#39;s authenticated Glances monitoring data — including full process lists with command-line arguments — by exploiting the browser&#39;s automatic replay of cached HTTP Basic Auth credentials in a cross-origin request.</p> <p>### Details `glances/outputs/glances_restful_api.py:298`: ```python if cors_origins == [&#34;*&#34;] and cors_credentials: logger.warning(...) cors_credentials = False ``` The intended guarantee is documented in `glances/outputs/glances_stdout_api_restful_doc.py:247-260`: *&#34;Setting cors_credentials=True with cors_origins=* is not allowed. Glances will automatically disable credentials and log a warning if this combination is detected.&#34;* The exact-equality comparison only matches when `cors_origins` is preci…</p> https://cve.radiocsirt.org/vuln/ghsa-fp27-88fp-2phg https://cve.radiocsirt.org/vuln/opensuse-su-2026:11674-1 <p>glances-common-4.5.6-1.1 on GA media</p> <p>glances-common-4.5.6-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11674-1 https://cve.radiocsirt.org/vuln/pysec-2026-3667 <p><strong>Affected:</strong> PyPI: glances</p> <p>### Summary Glances&#39;s REST API server includes a documented safety check intended to guarantee that `cors_credentials=True` can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality (`cors_origins == [&#34;*&#34;]`) instead of a membership test. Any multi-entry origin configuration that merely includes `&#34;*&#34;` alongside other origins (e.g. `cors_origins=*,https://trusted.example.com`) bypasses the check entirely, while Starlette&#39;s underlying `CORSMiddleware` still treats the presence of `&#34;*&#34;` anywhere in the list as &#34;allow all origins&#34; and reflects the request&#39;s actual `Origin` header together with `Access-Control-Allow-Credentials: true`. This allows any website to read a victim&#39;s authenticated Glances monitoring data — including full process lists with command-line arguments — by exploiting the browser&#39;s automatic replay of cached HTTP Basic Auth credentials in a cross-origin request.</p> <p>### Details `glances/outputs/glances_restful_api.py:298`: ```python if cors_origins == [&#34;*&#34;] and cors_credentials: logger.warning(...) cors_credentials = False ``` The intended guarantee is documented in `glances/outputs/glances_stdout_api_restful_doc.py:247-260`: *&#34;Setting cors_credentials=True with cors_origins=* is not allowed. Glances will automatically disable credentials and log a warning if this combination is detected.&#34;* The exact-equality comparison only matches when `cors_origins` is preci…</p> <p><strong>Affected:</strong> PyPI: glances</p> <p>### Summary Glances&#39;s REST API server includes a documented safety check intended to guarantee that `cors_credentials=True` can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality (`cors_origins == [&#34;*&#34;]`) instead of a membership test. Any multi-entry origin configuration that merely includes `&#34;*&#34;` alongside other origins (e.g. `cors_origins=*,https://trusted.example.com`) bypasses the check entirely, while Starlette&#39;s underlying `CORSMiddleware` still treats the presence of `&#34;*&#34;` anywhere in the list as &#34;allow all origins&#34; and reflects the request&#39;s actual `Origin` header together with `Access-Control-Allow-Credentials: true`. This allows any website to read a victim&#39;s authenticated Glances monitoring data — including full process lists with command-line arguments — by exploiting the browser&#39;s automatic replay of cached HTTP Basic Auth credentials in a cross-origin request.</p> <p>### Details `glances/outputs/glances_restful_api.py:298`: ```python if cors_origins == [&#34;*&#34;] and cors_credentials: logger.warning(...) cors_credentials = False ``` The intended guarantee is documented in `glances/outputs/glances_stdout_api_restful_doc.py:247-260`: *&#34;Setting cors_credentials=True with cors_origins=* is not allowed. Glances will automatically disable credentials and log a warning if this combination is detected.&#34;* The exact-equality comparison only matches when `cors_origins` is preci…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3667 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68517 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: glances, Ubuntu:Pro:18.04:LTS: glances, Ubuntu:Pro:20.04:LTS: glances, Ubuntu:22.04:LTS: glances, Ubuntu:24.04:LTS: glances, Ubuntu:26.04:LTS: glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: glances, Ubuntu:Pro:18.04:LTS: glances, Ubuntu:Pro:20.04:LTS: glances, Ubuntu:22.04:LTS: glances, Ubuntu:24.04:LTS: glances, Ubuntu:26.04:LTS: glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68517