AIKIDO-2026-593910
glances is vulnerable to Permissive Cross-domain Policy with Untrusted Domains
65
Medium Risk
This Affects:
glancesTL;DR
Glances includes a guard that disables CORS credentials when the configured origin list is the wildcard, intended to prevent credentialed cross-origin access to the REST API. The check compares the origin list to the wildcard using exact list equality instead of a membership test. Any multi-entry cors_origins list that merely contains the wildcard bypasses the guard, while the underlying middleware still treats the wildcard as allow-all and reflects the request origin together with credentials. The fix changes the guard to a membership test so any origin list containing the wildcard disables credentials.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the REST API with cors_credentials enabled and a multi-entry cors_origins list that includes the wildcard alongside other origins.
Background info
glances is vulnerable to Permissive Cross-domain Policy with Untrusted Domains in versions 4.5.2 - 4.5.5.
How to fix this
Upgrade the glances library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.