Glances
CVE-2026-30928
HIGH
GHSA-gh4x-f7cq-wwx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP GET request
-
ExploitAccess /api/4/config endpoint
-
ExecutionRetrieve unfiltered configuration dictionary
-
ImpactExtract database passwords and API tokens
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against Glances versions prior to 4.5.1 with /api/4/config REST API endpoint enabled on network-accessible interface. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Glances is an open-source system cross-platform monitoring tool. versions up to 4.5.1 is affected by information exposure.
RemediationAI
Fixed in version 4.5.1..
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-200: Information Exposure) affects Glances is an open-source system cross-platform monitoring tool.. Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
Know when Glances gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
Executive ViewAI
Organizations using Glances face notable risk from CVE-2026-30928, a information exposure vulnerability rated CVSS 7.5. This could expose sensitive information including credentials, configuration data, or user records to unauthorized parties. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict access to affected endpoints; (2) Implement additional authorization checks; (3) Enable audit logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Glances Configuration and SQL Injection Flaws
View all 2The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse unt
Command injection in Glances prior to 4.5.6 allows a local unprivileged user to execute arbitrary shell commands when ad
Command injection in Glances system monitoring (versions 4.5.2 through 4.5.5) allows a local attacker with process-execu
Cross-origin data exfiltration in Glances web server allows remote unauthenticated attackers to read sensitive system in
Server-Side Request Forgery in Glances IP plugin allows authenticated attackers to force the monitoring application to s
Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the `--disable-config-exec` flag correctly
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a
Cassandra export module in Glances prior to version 4.5.4 allows local privilege-escalated users to redirect monitoring
Credential disclosure in Glances prior to 4.5.6 allows unauthenticated remote attackers to retrieve plaintext usernames
Exploit-DB