The vulnerability in nicolargo Glances (CVE-2026-33533) involves a permissive CORS policy combined with insufficient Content-Type validation in the XML-RPC server component. When running versions before 4.5.3 with the server mode enabled, the application sets Access-Control-Allow-Origin: * on all HTTP responses. Because the XML-RPC handler accepts POST requests with Content-Type: text/plain without preflight checks, an attacker can craft a malicious webpage that sends a valid XML-RPC payload to the server. The server processes the request and returns comprehensive system monitoring data, which the attacker’s JavaScript can read due to the wildcard CORS header. This leads to unauthorized disclosure of sensitive system information. The issue is resolved by updating to Glances version 4.5.3.

An attacker can remotely exfiltrate detailed system information including hostname, operating system version, IP addresses, CPU, memory, disk, and network statistics, as well as the full process list with command line arguments. This data may contain sensitive tokens, passwords, or internal paths, leading to significant information disclosure. The vulnerability does not require authentication and can be exploited via a malicious webpage without user privileges on the target system.

This vulnerability is fixed in Glances version 4.5.3. Users should upgrade to version 4.5.3 or later to remediate the issue. No additional mitigations are required once the update is applied.