Glances ships with a default Cross-Origin Resource Sharing configuration that allows any origin to send requests with credentials. Because the server sets allow_origins to accept all origins while also enabling allow_credentials, the middleware reflects the Origin header back to the client instead of returning a wildcard. This flaw permits a malicious website to issue authenticated API calls to the Glances REST interface, leaking sensitive monitoring data, configuration secrets, and command line arguments from any user who has an active browser session. The weakness is a CORS misconfiguration (CWE‑942) that compromises confidentiality.

The issue affects the open‑source Glances monitoring tool developed by nicolargo. Versions prior to 4.5.2 are vulnerable; the safest version to run is 4.5.2 or newer where the bug is fixed.

The CVSS score of 8.1 classifies the vulnerability as high severity. The EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, any web page accessed by a user with an authenticated Glances session can initiate malicious requests, making the risk of data theft significant in environments where the Glances server is reachable from untrusted networks or publicly exposed. The attack vector is mainly web‑browser based, requiring an active session through standard authentication mechanisms.