CVE-2026-35587

CVE-2026-35587 is a Server-Side Request Forgery (SSRF) vulnerability in Glances versions prior to 4.5.4, an open-source cross-platform system monitoring tool. The flaw exists in the IP plugin where the public_api configuration parameter is insufficiently validated and passed directly to HTTP requests without scheme or hostname restrictions. This allows attackers with configuration access to direct the application to arbitrary endpoints and potentially leak credentials if public_username and public_password are configured. The vulnerability carries a FAUCET Risk Score of 37.0/100 and can be exploited with low complexity by a local or privileged attacker who can modify the Glances configuration file. The attack vector enables access to internal network services, retrieval of sensitive data from cloud metadata endpoints, and exfiltration of authentication credentials via the Authorization header to attacker-controlled servers. The EPSS score of 0.00013 indicates minimal current exploitation probability relative to the broader CVE landscape. There is currently no evidence of active exploitation in the wild, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue remains on the inactive hot list with no publicly available exploit code identified. Organizations running Glances should upgrade to version 4.5.4 or later and review configuration access controls to prevent unauthorized modification of the public_api parameter.