The vulnerability in nicolargo Glances (CVE-2026-68517) involves the cors_origins guard in glances/outputs/glances_restful_api.py, which prior to version 4.5.6 uses exact list equality checks instead of proper wildcard membership validation. This flaw allows a multi-origin list containing a wildcard to retain CORS credentials, potentially exposing authenticated REST API data to untrusted domains visited by users who have previously authenticated. The issue is fixed in version 4.5.6.

An attacker controlling or hosting an untrusted website could receive authenticated REST API data from a Glances instance if a user previously authenticated to the API visits the malicious site. This could lead to unauthorized disclosure of sensitive monitoring data. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality.

Upgrade Glances to version 4.5.6 or later, where the issue is fixed. Patch status is confirmed by the vendor stating the fix in 4.5.6. Until upgrading, avoid visiting untrusted websites while authenticated to the Glances REST API to reduce risk.