CVE-2026-46608

{
  "id": "CVE-2026-46608",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T19:16:37.663",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE-2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: * whenever cors_origins contains more than one entry. An operator who configures an explicit two-entry allowlist (e.g. two internal dashboard origins) intending to restrict browser access instead receives the unrestricted wildcard. A malicious web page served from any origin can issue a CORS simple request to /RPC2 and read the full system monitoring dataset without the victim's knowledge. This vulnerability is fixed in 4.5.5."
    },
    {
      "lang": "es",
      "value": "Glances es una herramienta de monitoreo de sistema multiplataforma de código abierto. Antes de la versión 4.5.5, el servidor XML-RPC de Glances (glances -s) introdujo una lista configurable de orígenes CORS en la versión 4.5.3 como una mitigación para CVE-2026-33533. Sin embargo, la implementación vuelve silenciosamente a Access-Control-Allow-Origin: * siempre que cors_origins contenga más de una entrada. Un operador que configura una lista de permitidos explícita de dos entradas (por ejemplo, dos orígenes de panel interno) con la intención de restringir el acceso del navegador, en su lugar, recibe el comodín sin restricciones. Una página web maliciosa servida desde cualquier origen puede emitir una solicitud simple CORS a /RPC2 y leer el conjunto completo de datos de monitoreo del sistema sin el conocimiento de la víctima. Esta vulnerabilidad está corregida en la versión 4.5.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nicolargo",
          "product": "glances",
          "versions": [
            {
              "version": "< 4.5.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T17:50:40.059541Z",
          "id": "CVE-2026-46608",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-183"
        },
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr",
      "source": "[email protected]"
    }
  ]
}