Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-17T18:18:06.753Z",
  "pubdate": "2026-08-17T18:18:06.753Z",
  "executiveSummary": "Glances versions prior to 4.5.6 suffer from an unauthorized information disclosure vulnerability residing within the configuration processing logic. Specifically, the flaw involves the as_dict_secure() function located in glances/config.py, which performs insufficient validation by exclusively checking option names rather than fully sanitizing sensitive configuration values. This security failing results in the inadvertent exposure of sensitive data, including public_username and embedded credentials defined within public_api values. Threat actors can leverage unauthenticated HTTP GET requests directed to the public API endpoints GET /api/4/config and GET /api/4/config/ip to extract this sensitive configuration data without requiring prior authentication or valid session credentials. The risk implications include unauthorized access to internal system parameters and potential credential leakage, which severely compromises the confidentiality posture of the monitored infrastructure. Exploitation requires network accessibility to the vulnerable Glances monitoring service and the ability to issue standard HTTP requests to the exposed API routes, allowing low-privileged or unauthenticated external entities to harvest critical operational secrets.",
  "technicalDetails": "The vulnerability originates from inadequate parameter filtering and sanitization within the as_dict_secure() function implemented in the glances/config.py file of the Glances monitoring tool. During the processing and serialization of system configuration data for API consumption, the security filtering mechanism evaluates only the option names while failing to inspect and redact associated sensitive values or nested structures containing confidential parameters. Consequently, sensitive data entries such as public_username and explicit credentials embedded inside public_api configuration settings bypass the intended security controls and are included in the serialized output returned to API callers. The vulnerable component is directly exposed via the web application interface through two unauthenticated routing endpoints: GET /api/4/config and GET /api/4/config/ip. The attack flow proceeds as an unauthenticated network adversary issues standard HTTP GET requests to either of these designated endpoints. Upon receipt of the request, the underlying Flask or web application framework invokes the flawed configuration serialization routine. The as_dict_secure() function processes the configuration dictionary and returns the payload containing the unredacted credentials and sensitive attributes in the HTTP response body. Because these API paths enforce neither authentication nor authorization checks, any remote attacker with network connectivity to the Glances service can successfully execute this enumeration vector. The post-exploitation impact includes the recovery of administrative or operational usernames and hardcoded authentication credentials, which can subsequently be leveraged to mount secondary attacks, achieve lateral movement, or gain unauthorized administrative control over the monitored target systems and related infrastructural services."
}