CVE-2026-32634

Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

• Credential exfiltration from browser operators: An adjacent-network attacker can harvest the reusable Glances authentication secret from operators running Central Browser mode with saved passwords.
• Authentication replay: The captured pbkdf2-derived Glances password hash can be replayed against Glances servers that use the same credential.
• REST/WebUI click-through abuse: For REST servers, webbrowser.open(self.servers_list.get_uri(server)) can open attacker-controlled URLs with embedded credentials.
• No user click required for background theft: The stats refresh thread uses the vulnerable path automatically once the fake service is marked PROTECTED.
• Affected scope: This is limited to Central Browser deployments with autodiscovery enabled and saved/default passwords configured. Static server entries and standalone non-browser use are not directly affected by this specific issue.

CVE-2026-32634 has a CVSS score of 8.1 (High). The vector is reachable from an adjacent network, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.5.2); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Use the discovered ip as the only network destination for autodiscovered servers, and do not automatically apply saved or default passwords to dynamic entries.

# glances/servers_list.py

def _get_connect_host(self, server):
    if server.get('type') == 'DYNAMIC':
        return server['ip']
    return server['name']

def _get_preconfigured_password(self, server):
    # Dynamic Zeroconf entries are untrusted and should not inherit saved/default creds
    if server.get('type') == 'DYNAMIC':
        return None
    return self.password.get_password(server['name'])

def get_uri(self, server):
    host = self._get_connect_host(server)
    if server['password'] != "":
        if server['status'] == 'PROTECTED':
            clear_password = self._get_preconfigured_password(server)
            if clear_password is not None:
                server['password'] = self.password.get_hash(clear_password)
        return 'http://{}:{}@{}:{}'.format(server['username'], server['password'], host, server['port'])
    return 'http://{}:{}'.format(host, server['port'])

And use the same _get_preconfigured_password() logic in glances/client_browser.py instead of calling self.servers_list.password.get_password(server['name']) directly.

1. What is CVE-2026-32634? CVE-2026-32634 is a high-severity security vulnerability in Glances (pip), affecting versions < 4.5.2. It is fixed in 4.5.2.
2. How severe is CVE-2026-32634? CVE-2026-32634 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of Glances are affected by CVE-2026-32634? Glances (pip) versions < 4.5.2 is affected.
4. Is there a fix for CVE-2026-32634? Yes. CVE-2026-32634 is fixed in 4.5.2. Upgrade to this version or later.
5. Is CVE-2026-32634 exploitable, and should I be worried? Whether CVE-2026-32634 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-32634 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-32634? Upgrade Glances to 4.5.2 or later.

Other vulnerabilities in Glances