Read the docs
TI-2026-23753 Aliases CVE-2026-30928GHSA-gh4x-f7cq-wwx6

Glances Exposes Unauthenticated Configuration Secrets

Priority MEDIUM 47CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0181 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed glances (nicolargo): 4.5.1Glances (PyPI): 4.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nicolargoglancesbefore 4.5.14.5.1Patch availableCNA
—Glances (PyPI)before 4.5.14.5.1Patch availableGHSA-gh4x-f7cq-wwx6
  • glances Vendornicolargo Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Glances (PyPI) Vendor— Affected before 4.5.1 Fixed in 4.5.1 Patch available GHSA-gh4x-f7cq-wwx6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*before 4.5.1Vulnerablenicolargo
  • cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:* Versions before 4.5.1 Vulnerable ·nicolargo

Remediation

  • Fix · CNA glances (nicolargo) Fixed in 4.5.1
  • Fix · GHSA-gh4x-f7cq-wwx6 Glances (PyPI) Fixed in 4.5.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30928
  2. 2026-10-03 Alias added: GHSA-gh4x-f7cq-wwx6

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-25142 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` CVSS 3.1CRITICAL 9.1
  • TI-2026-25106 Glances exposes the REST API without authentication CVSS 4.0HIGH 8.7
  • TI-2026-27083 Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS CVSS 4.0HIGH 7.7
  • TI-2026-25120 Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements CVSS 3.1CRITICAL 9.1
  • TI-2026-25118 Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials CVSS 3.1HIGH 7.5
  • TI-2026-25143 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences