CVE-2026-68520 in Glances
Summary
by MITRE • 08/17/2026
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
Glances, a widely utilized open-source system monitoring tool designed for cross-platform compatibility, contains a critical information disclosure vulnerability affecting versions prior to 4.5.6. The flaw resides within the configuration handling logic, specifically in the as_dict_secure function located in the glances/config.py module. This component is responsible for sanitizing and returning configuration data via the application's REST API endpoints. In vulnerable iterations of the software, the security checks implemented are insufficiently rigorous, focusing primarily on validating option names while neglecting to adequately scrub sensitive credential information embedded within public_api values before transmission.
The technical root cause stems from an improper neutralization of special elements during output rendering against untrusted input contexts. When a client issues an authenticated or even unauthenticated GET request to the /api/4/config endpoint, the server processes the configuration dictionary and returns it in JSON format. Due to the flawed sanitization logic, sensitive fields such as public_username and associated credentials are inadvertently included in the response payload alongside standard system metrics and non-sensitive settings. This behavior persists across multiple API routes that expose configuration data, including GET /api/4/config/ip requests, thereby creating a consistent vector for information leakage regardless of whether the caller is attempting to retrieve general config or IP-specific details.
The operational impact of this vulnerability is severe due to its potential for unauthenticated exploitation. An attacker who can reach the Glances API endpoint over the network does not require valid credentials to extract these sensitive values. The exposure of public usernames and embedded passwords compromises the confidentiality of authentication mechanisms, potentially allowing further unauthorized access if those credentials are reused across other services or systems. This aligns with CWE-200, which classifies this as an Information Exposure vulnerability where security-sensitive information is disclosed without explicit authorization. Furthermore, from a threat modeling perspective utilizing the MITRE ATT&CK framework, this behavior corresponds to T1504.003, specifically Web Service Discovery, and potentially T1078.001 for Default Accounts if default credentials are exposed, facilitating lateral movement or privilege escalation in subsequent attack phases.
To mitigate this risk, organizations running Glances must immediately upgrade to version 4.5.6 or later where the as_dict_secure function has been patched to properly filter out sensitive data before serialization and transmission. In environments where upgrading is not immediately feasible, administrators should restrict network access to the Glances API endpoints using firewall rules or reverse proxy configurations that enforce authentication requirements for all configuration-related requests. Additionally, implementing strict input validation and ensuring that security-critical fields are explicitly excluded from public-facing API responses will prevent similar information leakage in future deployments. Regular auditing of API response payloads against known sensitive data patterns is also recommended to detect any residual exposure risks.