Is CVE-2026-32633 actively exploited?

CVE-2026-32633 has no public evidence of in-the-wild exploitation as of 2026-03-19.

What is the CVSS score for CVE-2026-32633?

CVE-2026-32633 has a CVSS score of 9.1 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

How do I patch CVE-2026-32633?

Patch guidance is available from nicolargo security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-32633.

Fix CVE-2026-32633 - CRITICAL nicolargo glances

Description

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw server objects from `GlancesServersList.get_servers_list()`. Those objects are mutated in-place during background polling and can contain a `uri` field with embedded HTTP Basic credentials for downstream Glances servers, using the reusable pbkdf2-derived Glances authentication secret. If the front Glances Browser/API instance is started without `--password`, which is supported and common for internal network deployments, `/api/4/serverslist` is completely unauthenticated. Any network user who can reach the Browser API can retrieve reusable credentials for protected downstream Glances servers once they have been polled by the browser instance. Version 4.5.2 fixes the issue.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none
Weaknesses: CWE-200 · Information Disclosure CWE-522 · Insufficiently Protected Credentials CWE-522 · Insufficiently Protected Credentials

Metadata

Primary Vendor: NICOLARGO
Published: 3/18/2026
Last Modified: 3/19/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2026-32633

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary