Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths). This issue has been patched in version 4.5.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-
    RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every
    HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-
    controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a
    valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the
    XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's
    JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses,
    CPU/memory/disk/network stats, and the full process list including command lines (which often contain
    tokens, passwords, or internal paths). This issue has been patched in version 4.5.3. (CVE-2026-33533)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-     RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every     HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-     controlled webpage can issue a CORS simple request (POST with Content-Type: text/plain) containing a     valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the     XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's     JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses,     CPU/memory/disk/network stats, and the full process list including command lines (which often contain     tokens, passwords, or internal paths). This issue has been patched in version 4.5.3. (CVE-2026-33533)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
440912	SCA: security update for Glances (GHSA-7p93-6934-f4q7)	Tenable Cloud Security	SCA Checks	high
440912	SCA: security update for Glances (GHSA-7p93-6934-f4q7)	Tenable Self-Hosted Container Security	SCA Checks	high
304873	Linux Distros Unpatched Vulnerability : CVE-2026-33533	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33533

high

Tenable Plugins

high

high

high