Nixpkgs security tracker

Untriaged

Permalink CVE-2026-46608

7.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 2 months ago Activity log

Created suggestion 2 months ago

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE-2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: * whenever cors_origins contains more than one entry. An operator who configures an explicit two-entry allowlist (e.g. two internal dashboard origins) intending to restrict browser access instead receives the unrestricted wildcard. A malicious web page served from any origin can issue a CORS simple request to /RPC2 and read the full system monitoring dataset without the victim's knowledge. This vulnerability is fixed in 4.5.5.

References

https://github.com/nicolargo/glances/security/advisories/GHSA-87qc-fj39-wccr x_refsource_CONFIRM
https://github.com/nicolargo/glances/releases/tag/v4.5.5 x_refsource_MISC

Affected products

glances

==< 4.5.5

Matching in nixpkgs

pkgs.glances

Cross-platform curses-based monitoring tool

nixos-unstable -
- nixos-unstable-small 4.5.4
nixos-26.05 -
- nixos-26.05-small 4.5.4

pkgs.python312Packages.glances-api

None

pkgs.python313Packages.glances-api

Python API for interacting with Glances

nixos-unstable -
- nixos-unstable-small 0.10.0
nixos-26.05 -
- nixos-26.05-small 0.10.0

pkgs.python314Packages.glances-api

Python API for interacting with Glances

nixos-unstable -
- nixos-unstable-small 0.10.0
nixos-26.05 -
- nixos-26.05-small 0.10.0

pkgs.home-assistant-component-tests.glances

None

Untriaged

Permalink CVE-2026-46611

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 2 months ago Activity log

Created suggestion 2 months ago

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.