{
  "cveId": "CVE-2026-32633",
  "url": "https://patchblox.com/security/cve/CVE-2026-32633",
  "summary": "CVE-2026-32633 is fixed in glances on 1 platform by DEBIAN-CVE-2026-32633 (version 4.5.2\u002Bdfsg-1), released March 18, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "glances: Glances is an open-source system cross-platform monitoring tool",
  "description": "Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the \u0060/api/4/serverslist\u0060 endpoint returns raw server objects from \u0060GlancesServersList.get_servers_list()\u0060. Those objects are mutated in-place during background polling and can contain a \u0060uri\u0060 field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without \u0060--password\u0060, which is supported and common for internal network deployments, \u0060/api/4/serverslist\u0060 is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.",
  "published": "2026-03-18T18:16:28Z",
  "severity": "critical",
  "cvss": 9.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss": 0.00501,
  "epssPercentile": 0.43189,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "glances",
      "release": "Debian 14",
      "fixedVersion": "4.5.2\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-32633",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-32633",
      "released": "2026-03-18T18:16:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}