Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware` reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead of returning the literal `*` wildcard. This effectively grants any website the ability to make credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system monitoring information, configuration secrets, and command line arguments from any user who has an active browser session with a Glances instance. Version 4.5.2 fixes the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST     API web server ships with a default CORS configuration that sets `allow_origins=[*]` combined with     `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware`     reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead     of returning the literal `*` wildcard. This effectively grants any website the ability to make     credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system     monitoring information, configuration secrets, and command line arguments from any user who has an active     browser session with a Glances instance. Version 4.5.2 fixes the issue. (CVE-2026-32610)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST
    API web server ships with a default CORS configuration that sets `allow_origins=["*"]` combined with
    `allow_credentials=True`. When both of these options are enabled together, Starlette's `CORSMiddleware`
    reflects the requesting `Origin` header value in the `Access-Control-Allow-Origin` response header instead
    of returning the literal `*` wildcard. This effectively grants any website the ability to make
    credentialed cross-origin API requests to the Glances server, enabling cross-site data theft of system
    monitoring information, configuration secrets, and command line arguments from any user who has an active
    browser session with a Glances instance. Version 4.5.2 fixes the issue. (CVE-2026-32610)

ID	Name	Product	Family	Type	Severity
302943	Linux Distros Unpatched Vulnerability : CVE-2026-32610	Nessus	Misc.	Local	high
438837	SCA: security update for Glances (GHSA-9jfm-9rc6-2hfq)	Tenable Cloud Security	SCA Checks	Local	high
438837	SCA: security update for Glances (GHSA-9jfm-9rc6-2hfq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-32610

high

Tenable Plugins

high

high

high