Cross-Site Resource Sharing Vulnerability in Glances Monitoring Tool

CVE-2026-33533

What is CVE-2026-33533?

Glances, an open-source cross-platform monitoring tool, prior to version 4.5.3, contains a vulnerability in its XML-RPC server. This server, when engaged, indiscriminately sends Access-Control-Allow-Origin: * in every HTTP response. An external attacker can exploit this flaw by crafting a particular CORS 'simple request' from a malicious webpage. The request can include a valid XML-RPC payload with the Content-Type set to text/plain, bypassing the CORS protocol's preflight checks. Consequently, the server processes this XML body and discloses sensitive system details including hostname, OS version, and extensive resource statistics. Most alarmingly, it allows attackers to retrieve the complete process list, which may unintentionally leak tokens, passwords, or internal paths. Users are advised to update to version 4.5.3 immediately, as this release addresses the aforementioned vulnerabilities.

References