AIKIDO-2026-27395

glances is vulnerable to Insufficiently Protected Credentials

Insufficiently Protected CredentialsCVE-2026-68520 Published 4 days ago

Medium Risk

This Affects:

glances

4.5.1 - 4.5.5

Fixed in 4.5.6

Are you affected? Scan for Free

TL;DR

Glances exposes a sanitised configuration view through the unauthenticated /api/4/config endpoint using as_dict_secure(). The sanitiser only masks values whose key name matches a sensitive-key pattern and never inspects value content. Credentials embedded in the [ip] section public_api URL userinfo and the public_username value are returned in full to unauthenticated callers, while public_password is masked. The fix adds value-level redaction so credential-bearing configuration values are masked before the response is served.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run Glances in web server or REST API mode without authentication and have configured credentials in the [ip] section public_api URL or a public_username.