CVE-2026-34839
Description
A flaw was found in Glances, an open-source system monitoring tool. The Glances web server's REST API, accessible without authentication, has a permissive Cross-Origin Resource Sharing (CORS) policy. This vulnerability allows a malicious website to read sensitive system information from a running Glances instance in a victim's browser, leading to unauthorized data disclosure.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this vulnerability, restrict network access to the Glances web server or disable its web interface if not essential. Configure a firewall to limit connections to the Glances listening port (default 61208/TCP) to trusted networks or localhost only. Alternatively, launch Glances with the `--disable-web` or `--no-browser` command-line options to prevent the web server from starting. If Glances is managed as a system service, update its configuration to include these options and restart the service for the changes to apply.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
