CVE-2026-126955: Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.8.8
Event History
Frequently Asked Questions
Which deployments are exposed to page-slug enumeration?
Glance versions 0.8.0 through 0.8.7 are affected. An unauthenticated remote party can probe configured page slugs through either /{page} or /api/pages/{page}/content/.
How can an attacker distinguish a valid hidden page slug from an invalid one?
The attacker submits candidate page names and compares HTTP responses. Valid configured slugs produce 303 or 401 responses, while nonexistent slugs return 404.
Does exploitation require an account or user interaction?
No. The issue is reachable over the network without authentication or user interaction, and only requires requests containing candidate page names.
What is the available remediation?
Upgrade Glance to version 0.8.8 or later. The issue affects releases before 0.8.8.