EUVD-2026-60302
GHSA-4h34-v6r8-mmjc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated API endpoint; no auth required once preconditions are met; only partial confidentiality loss from specific config values.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 4 pypi packages depend on glances (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.5.6.
DescriptionCVE.org
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.
AnalysisAI
Credential disclosure in Glances prior to 4.5.6 allows unauthenticated remote attackers to retrieve plaintext usernames and credential-bearing URLs from the system monitoring tool's REST API. The flaw exists in as_dict_secure() within glances/config.py, which was designed to sanitize configuration data for no-auth API access but filters only on configuration key names - never on values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default conditions to be simultaneously true: (1) Glances must be running in web server mode without the --password authentication flag - this is the default for many deployments but is not the only deployment mode; and (2) the glances.conf [ip] section must contain either a public_api value with embedded URL credentials (scheme://user:pass@host/ format) or a public_username value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall real-world risk is moderate-to-low given the specific prerequisites required for exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who discovers a Glances instance running in its default no-auth web server mode sends a simple unauthenticated HTTP GET request to /api/4/config/ip. If the target's glances.conf has an [ip] section with public_api=https://admin:secret123@ipv4.ipleak.net/json/ or a public_username=myname entry, the API returns those values in plaintext JSON, exposing the credentials. … |
| Remediation | The primary remediation is to upgrade Glances to version 4.5.6 or later, available via pip install --upgrade glances and the updated Docker image nicolargo/glances:latest. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse unt
Command injection in Glances prior to 4.5.6 allows a local unprivileged user to execute arbitrary shell commands when ad
Glances is an open-source system cross-platform monitoring tool. versions up to 4.5.1 is affected by information exposur
Command injection in Glances system monitoring (versions 4.5.2 through 4.5.5) allows a local attacker with process-execu
SQL injection in Glances TimescaleDB export module allows local attackers to execute arbitrary SQL commands against the
Glances versions through 4.5.5 contain an incomplete fix for CVE-2026-53925: the `--disable-config-exec` flag correctly
Glances REST API prior to 4.5.6 exposes authenticated system monitoring data to untrusted cross-origin websites due to a
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today