AIKIDO-2026-27395
glances is vulnerable to Insufficiently Protected Credentials
53
Medium Risk
This Affects:
glancesTL;DR
Glances exposes a sanitised configuration view through the unauthenticated /api/4/config endpoint using as_dict_secure(). The sanitiser only masks values whose key name matches a sensitive-key pattern and never inspects value content. Credentials embedded in the [ip] section public_api URL userinfo and the public_username value are returned in full to unauthenticated callers, while public_password is masked. The fix adds value-level redaction so credential-bearing configuration values are masked before the response is served.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run Glances in web server or REST API mode without authentication and have configured credentials in the [ip] section public_api URL or a public_username.
Background info
glances is vulnerable to Insufficiently Protected Credentials in versions 4.5.1 - 4.5.5.
How to fix this
Upgrade the glances library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.