CVE-2026-68517

### Summary Glances's REST API server includes a documented safety check intended to guarantee that `cors_credentials=True` can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality (`cors_origins == ["*"]`) instead of a membership test. Any multi-entry origin configuration that merely includes `"*"` alongside other origins (e.g. `cors_origins=*,https://trusted.example.com`) bypasses the check entirely, while Starlette's underlying `CORSMiddleware` still treats the presence of `"*"` anywhere in the list as "allow all origins" and reflects the request's actual `Origin` header together with `Access-Control-Allow-Credentials: true`. This allows any website to read a victim's authenticated Glances monitoring data — including full process lists with command-line arguments — by exploiting the browser's automatic replay of cached HTTP Basic Auth credentials in a cross-origin request. ### Details `glances/outputs/glances_restful_api.py:298`: ```python if cors_origins == ["*"] and cors_credentials: logger.warning(...) cors_credentials = False ``` The intended guarantee is documented in `glances/outputs/glances_stdout_api_restful_doc.py:247-260`: *"Setting cors_credentials=True with cors_origins=* is not allowed. Glances will automatically disable credentials and log a warning if this combination is detected."* The exact-equality comparison only matches when `cors_origins` is precisely the single-element list `["*"]`. Starlette's `CORSMiddleware`, by contrast, determines wildcard behavior via `"*" in allow_origins` — a membership test — so any multi-entry list containing `"*"` is still treated by Starlette as "allow all origins," while Glances's own guard silently fails to disable credentials for that case, breaking the documented guarantee with no warning logged. This is the same exact-match-versus-membership-test bug shape that CVE-2026-46608 fixed in the sibling XML-RP