{"id":"CVE-2026-32634","aliases":["GHSA-vx5f-957p-qpvm","PYSEC-2026-2172"],"url":"https://o3.security/vulnerability/CVE-2026-32634","summary":"Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers","details":"Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue.","published":"2026-03-18T17:55:30.552Z","modified":"2026-08-07T11:48:53.074647692Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"glances","fixedVersion":"4.5.2"}],"fix":{"url":"https://github.com/nicolargo/glances/commit/61d38eec521703e41e4933d18d5a5ef6f854abd5","label":"nicolargo/glances@61d38ee"},"references":[{"type":"WEB","url":"https://github.com/nicolargo/glances/releases/tag/v4.5.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32634.json"},{"type":"ADVISORY","url":"https://github.com/nicolargo/glances/security/advisories/GHSA-vx5f-957p-qpvm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32634"},{"type":"FIX","url":"https://github.com/nicolargo/glances/commit/61d38eec521703e41e4933d18d5a5ef6f854abd5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:48:53.074647692Z"}}