Glances CVE-2026-68520

Exploitation requires two non-default conditions to be simultaneously true: (1) Glances must be running in web server mode without the --password authentication flag - this is the default for many deployments but is not the only deployment mode; and (2) the glances.conf [ip] section must contain either a public_api value with embedded URL credentials (scheme://user:pass@host/ format) or a public_username value. Without the [ip] section configured with these specific fields, the vulnerability yields no sensitive data. What limits exploitation further: the exposed credentials are specifically those used for the external IP API integration feature, not OS-level or Glances administrative credentials; the Glances web server port (default 61208) must be reachable from the attacker's location; and the attack yields only the credentials stored in that specific config section. Authentication (--password) fully prevents exploitation by routing the API response through the unredacted as_dict() path, which is only served to authenticated callers.

The overall real-world risk is moderate-to-low given the specific prerequisites required for exploitation. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects that exploitation requires no authentication and no user interaction over the network, but the confidentiality impact is limited to partial credential disclosure rather than full system compromise. Critically, the vulnerability only materializes when Glances is deployed in web server mode without the --password flag AND the [ip] configuration section is populated with public_username or a credential-bearing public_api URL - neither condition is part of the default installation. No CISA KEV listing and no confirmed public exploit code exist at time of analysis, suggesting this has not been opportunistically mass-exploited. The CVSS network vector (AV:N/PR:N) is technically accurate for the attack path once preconditions are met, but those preconditions meaningfully limit the exposed population. Organizations running Glances in monitoring stacks that integrate with external IP geolocation APIs via authenticated URLs are the primary risk group and should treat patching as urgent.

An attacker who discovers a Glances instance running in its default no-auth web server mode sends a simple unauthenticated HTTP GET request to /api/4/config/ip. If the target's glances.conf has an [ip] section with public_api=https://admin:secret123@ipv4.ipleak.net/json/ or a public_username=myname entry, the API returns those values in plaintext JSON, exposing the credentials. No exploit code is needed beyond a standard HTTP client such as curl.