Is CVE-2026-32609 actively exploited?

No active exploitation of CVE-2026-32609 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32609 be exploited remotely?

Yes. CVE-2026-32609 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32609?

CVE-2026-32609 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-32609

HIGH

CVE-2026-32609

CWE-200Published: March 18, 2026· Updated: Mar 19, 2026

7.5

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.4th

Official Description

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.

NVD Source

Technical Analysis

CVE-2026-32609 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.