Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central     Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for     dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the     discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted     name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on     the same local network can advertise a fake Glances service over Zeroconf and cause the browser to     automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects     the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2     fixes the issue. (CVE-2026-32634)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central
    Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for
    dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the
    discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted
    name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on
    the same local network can advertise a fake Glances service over Zeroconf and cause the browser to
    automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects
    the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2
    fixes the issue. (CVE-2026-32634)

ID	Name	Product	Family	Severity
302944	Linux Distros Unpatched Vulnerability : CVE-2026-32634	Nessus	Misc.	high
438843	SCA: security update for Glances (GHSA-vx5f-957p-qpvm)	Tenable Cloud Security	SCA Checks	high
438843	SCA: security update for Glances (GHSA-vx5f-957p-qpvm)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-32634

high

Tenable Plugins

high

high

high