CVE-2026-126954 · Other
NO FIX YET · SEE WHAT TO DO
Glance, a self-hosted dashboard, trusts a Widget-Title-URL response header from extension endpoints, so a malicious endpoint can inject javascript: URLs. When a user clicks the widget title, the script runs in the dashboard and can read pages and send content elsewhere.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Glance 0.7.9 through 0.8.x before 0.8.8 that use extension widgets. Exposure requires an extension endpoint that an attacker controls or can influence; installations using only built-in widgets or trusted endpoints are less exposed.
Not affected if default-config, no-extension-widgets, trusted-endpoints-only
Who cares dashboards, glance, self-hosted
glance --version or the image tag in your deployment; affected versions are 0.7.9 up to but not including 0.8.8.0.8.8 or later.Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.