Glances is an open‑source system monitoring tool. The XML‑RPC server, activated with glances -s or glances --server, incorrectly advertises a wildcard CORS header. Because the handler does not check the Content‑Type, a malicious web page can send a simple POST request with Content‑Type: text/plain containing a valid XML‑RPC payload. The browser does not perform a preflight check, the server processes the payload and returns the complete monitoring data, and the wildcard CORS header allows the attacker's JavaScript to read the response. The exposed data includes hostname, OS version, IP addresses, CPU, memory, disk, network statistics and the full process list with command lines that often contain secrets.

The affected vendor is nicolargo, product Glances. Any installation of Glances that runs the XML‑RPC server feature and uses a version older than 4.5.3 is vulnerable. Versions 4.5.3 and newer include the fix.

The CVSS score of 7.1 reflects moderate to high severity; no EPSS data is available and the vulnerability is not flagged in CISA’s KEV catalog. The likely attack vector is a browser‑based webpage controlled by an attacker that the victim visits while connected to the vulnerable Glances server. Because authentication is not required, any host that can reach the XML‑RPC endpoint can retrieve the full system state, potentially leaking credentials or other sensitive information.