AIKIDO-2026-27395
glances is vulnerable to Insufficiently Protected Credentials
53
CVE Score
Medium
Insufficiently Protected Credentials
TL;DR
Glances exposes a sanitised configuration view through the unauthenticated /api/4/config endpoint using as_dict_secure(). The sanitiser only masks values whose key name matches a sensitive-key pattern and never inspects value content. Credentials embedded in the [ip] section public_api URL userinfo and the public_username value are returned in full to unauthenticated callers, while public_password is masked. The fix adds value-level redaction so credential-bearing configuration values are masked before the response is served.
How do I fix this?
Upgrade the glances library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run Glances in web server or REST API mode without authentication and have configured credentials in the [ip] section public_api URL or a public_username.
Package
Versions
4.5.1 - 4.5.5
Fixed in 4.5.6Background info
glances is vulnerable to Insufficiently Protected Credentials in versions 4.5.1 - 4.5.5.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.