Server-Side Request Forgery Vulnerability in Glances IP Plugin by Glances
CVE-2026-35587

7.3HIGH

Key Information:

Vendor

Nicolargo

Status
Glances
Vendor
CVE Published:
20 April 2026

What is CVE-2026-35587?

The Glances IP plugin prior to version 4.5.4 contains a Server-Side Request Forgery (SSRF) vulnerability due to inadequate validation of the public_api configuration parameter. This flaw allows attackers to manipulate the Glances configuration, leading the application to send requests to unauthorized internal or external endpoints. Moreover, if public_username and public_password are configured, these credentials are transmitted in the Authorization: Basic header, risking exposure to malicious entities. This vulnerability can be exploited to compromise internal network services, retrieve sensitive data from cloud metadata endpoints, and facilitate credential exfiltration through unrestricted outbound HTTP requests. Version 4.5.4 addresses this critical oversight with a patch.

Affected Version(s)

glances < 4.5.4

References

https://github.com/nicolargo/glances/security/advisories/...
x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/d6808be667289...
x_refsource_MISC

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.