An unauthenticated attacker on the local network can intercept reusable authentication secrets from Glances, posing a significant risk to system security.

This is an origin validation error (CWE-346) where the application constructs connection URIs using untrusted Zeroconf-advertised names. An unauthenticated attacker can spoof a Glances service, causing the browser to disclose authentication secrets to an attacker-controlled host.

The vulnerability allows an attacker to capture authentication secrets, which could lead to unauthorized access to the Glances monitoring interface or underlying system. Given the CVSS score of 8.1, the potential for high impact on both confidentiality and integrity necessitates immediate attention, particularly in environments where Glances is used to manage sensitive infrastructure.

Immediate Action: Upgrade the Glances package to version 4.5.2 or higher via the appropriate package manager, such as pip for PyPI environments.

Proactive Monitoring: Review network traffic logs for unexpected Zeroconf service advertisements or unauthorized attempts to access the Glances REST/WebUI interfaces.

Compensating Controls: Restrict access to the Glances interface to trusted management networks and use network segmentation to prevent untrusted devices from interacting with the Zeroconf discovery protocol.

Public Exploit Available: No (exploit_available: false).

Due to the severity of credential exposure, administrators should prioritize updating Glances to version 4.5.2 immediately. Organizations should verify that their monitoring infrastructure is not exposed to untrusted local networks, as this remains the primary vector for exploitation.