Glances
CVE-2026-30928
HIGH
GHSA-gh4x-f7cq-wwx6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
AnalysisAI
Glances is an open-source system cross-platform monitoring tool. versions up to 4.5.1 is affected by information exposure.
Technical ContextAI
This vulnerability (CWE-200: Information Exposure) affects Glances is an open-source system cross-platform monitoring tool.. Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
RemediationAI
Fixed in version 4.5.1..
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse unt
Command injection in Glances prior to 4.5.6 allows a local unprivileged user to execute arbitrary shell commands when ad
Command injection in Glances system monitoring (versions 4.5.2 through 4.5.5) allows a local attacker with process-execu
SQL injection in Glances TimescaleDB export module allows local attackers to execute arbitrary SQL commands against the
Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the `--disable-config-exec` flag correctly
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a
Credential disclosure in Glances prior to 4.5.6 allows unauthenticated remote attackers to retrieve plaintext usernames
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today