# Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

Unauthenticated Glances Browser API /api/4/serverslist returns server objects whose uri embeds reusable pbkdf2-hashed downstream credentials, letting any network user replay them against protected Glances servers.

- Payout: Research
- Severity: critical
- Program: Glances
- Found by: offset
- Disclosed: 2026-03-16
- CVE: CVE-2026-32633
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-r297-p3v4-wp8m
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-r297-p3v4-wp8m
- Tags: area:web domain:api domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:critical tech:python technique:source-review vuln:auth-bypass vuln:cors vuln:info-disclosure vuln:secrets-leak

**Target:** Glances Browser REST API endpoint /api/4/serverslist
**Root cause:** The servers list endpoint returns raw in-memory server objects that are mutated in-place during polling to include a uri field with embedded HTTP Basic credentials (pbkdf2 hash of the saved/default password); the API router has no auth dependency unless the front instance was started with --password.
**Steps:**
1. Start Browser/API instance without front-end auth: `glances --browser -w -C ./glances.conf` with `[passwords] default=SuperSecretBrowserPassword`
2. Ensure a protected downstream server is polled and marked PROTECTED
3. From any reachable host: `curl -s http://TARGET:61208/api/4/serverslist`
4. Observe entries with `"uri": "http://glances:<pbkdf2_hash>@internal-glances.example:61209"`
5. Replay the disclosed hash as HTTP Basic auth against the downstream Glances server
**How found:** Code review of the servers list route and polling logic: noticed get_servers_list() returns raw mutated objects, traced __update_stats/get_uri to see credentials embedded in uri, and confirmed the router only adds auth when --password is set; validated with a local harness forcing a 401 to trigger PROTECTED status and credential embedding.
**Exploitation:** Any network user reaching the unauthenticated Browser API fetches /api/4/serverslist and extracts the pbkdf2-derived hash from each uri; that hash is the effective Glances client secret and is replayed via HTTP Basic against downstream protected servers, granting access to the whole monitored fleet.
**Escalation:** Chains with permissive default CORS: even with --password on the front instance, a malicious website can read /api/4/serverslist from an authenticated browser session cross-origin and steal the same downstream credentials.
**Insight:** When an API returns internal objects that background workers mutate in place, check whether those objects accumulate derived secrets (URIs with embedded auth, tokens) that the frontend then consumes directly; also check whether auth middleware is conditional on a startup flag.

## Proof of concept (copied exactly from the original report)

**curl request to unauthenticated serverslist endpoint**

```
curl -s http://TARGET:61208/api/4/serverslist
```

**Browser start command without front-end auth**

```
glances --browser -w -C ./glances.conf
```