CVE-2026-68517 is a CORS misconfiguration in Glances where the application incorrectly handles wildcard origins when multiple origins are configured. The vulnerability stems from a semantic inversion: the code uses list equality (cors_origins == ['*']) instead of membership testing ('*' in cors_origins). This means when multiple origins are configured, the wildcard check silently fails, and the server does not send the Access-Control-Allow-Credentials: true header with a wildcard origin — but the failure mode is subtle enough to pass testing and code review.
The bug only manifests when multiple origins are configured, which is increasingly common as Glances is deployed in complex infrastructure where monitoring dashboards must serve multiple subdomains. If your Glances instance is behind authentication and serving dashboards to users across different domains (e.g., monitoring.company.com, ops.company.com), and you have configured any CORS origin list containing a wildcard, you are likely affected.
The fix in version 4.5.6 replaces the equality check with proper wildcard membership detection. When auditing your own deployments, verify not just that you're on the patched version but that your CORS configuration doesn't rely on patterns that might still bypass the fix — particularly case variations, 'null' origin, or regex-style wildcards that the patch may not handle.
What makes this CVE notable is the threat model nuance: CVSS 6.5 underweights the severity because it doesn't account for the user population. Glances is a monitoring tool run by sysadmins and SREs whose sessions carry tokens with broad read access to production services. Compromising a monitoring session through CORS leakage exposes infrastructure-level credentials, not personal data. This changes prioritization — even if exploitability requires a previously authenticated user, the blast radius of a successful exploit extends into production service visibility.
Audit your Glances deployments now: check the CORS configuration file for any multi-origin setup involving wildcards, verify the version, and plan the upgrade to 4.5.6. If you're running a monitoring tool with CORS enabled, treat the origin configuration surface as a security boundary, not a deployment convenience flag.