{"id":46542,"date":"2026-04-20T13:41:10","date_gmt":"2026-04-20T08:11:10","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=46542"},"modified":"2026-04-20T13:41:54","modified_gmt":"2026-04-20T08:11:54","slug":"cve-2026-34839","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/vulnerability\/cve-2026-34839\/","title":{"rendered":"CVE-2026-34839: CORS Vulnerability in Glances"},"content":{"rendered":"
\n\n

Product Name:<\/strong> Glances
Vulnerability:<\/strong> Cross-Origin Information Disclosure
(CWE-200: Exposure of Sensitive Information)
Vulnerable Version: <\/strong><= 4.5.2
CVE:<\/strong> CVE-2026-34839 (High)<\/p>\n\n<\/div>\n\n\n

On 30\/03\/2025, a security researcher at Astra Security identified a Cross-Origin Information Disclosure vulnerability in Glances, a popular cross-platform system monitoring tool, affecting all versions up to and including 4.5.2.<\/p>\n\n\n\n

CVE-2026-34839 <\/strong>enables a malicious website to retrieve sensitive system data from a victim\u2019s machine simply by having them visit an attacker-controlled page.

If exploited, the threat actor could get a broad range of sensitive information, including running process lists, system performance metrics, and network configuration details. These data should never be accessible to untrusted third-party origins.<\/p>\n\n\n\n

<\/span>Technical Breakdown of CVE-2026-34839<\/span><\/h2>\n\n\n\n

The CVE-2026-34839<\/a> was discovered during a manual analysis of the application\u2019s API and network behavior. This flaw is very dangerous on office\/home networks where Glances is commonly run, and IPs are easy to find through simple scanning.<\/p>\n\n\n\n

How was it discovered?<\/h3>\n\n\n\n

Our researcher found CVE-2026-34839, when glances launched in web mode with the -w flag and bound to 0.0.0.0, the Glances web interface exposes a fully functional REST API<\/strong> on port 61208<\/strong>. This API endpoint requires no credentials to access and responds to cross-origin fetch requests from any domain.<\/p>\n\n\n\n

By studying the API response from \/api\/4\/all<\/strong>, it was confirmed that detailed system telemetry, i.e., process names, CPU usage, memory consumption, and network interfaces, was being returned without restriction to any browser-based request.<\/p>\n\n\n\n

How to replicate the vulnerability<\/h3>\n\n\n\n
    \n
  1. Start Glances in web mode<\/li>\n<\/ol>\n\n\n\n
    glances -w -B 0.0.0.0<\/code><\/pre>\n\n\n\n
      \n
    1. Set up or access a malicious webpage under attacker control.<\/li>\n\n\n\n
    2. Embed the following script in the malicious page:<\/li>\n<\/ol>\n\n\n\n
      fetch('http:\/\/<victim-ip>:61208\/api\/4\/all')\n\n  .then(r => r.json())\n\n  .then(data => console.log(data));<\/code><\/pre>\n\n\n\n
        \n
      1. When a victim visits the page, the browser silently sends the request to the Glances API.<\/li>\n\n\n\n
      2. Observe that the API returns sensitive system data without any authentication check or origin restriction.<\/li>\n<\/ol>\n\n\n\n