What’s Vulnerable › Vulnerabilities

CVE-2026-30928: Glances Exposes Unauthenticated Configuration Secrets

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-200

Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Affected products

• nicolargo glances: before 4.5.1 — fixed in 4.5.1

How to fix

Upgrade to a fixed version: nicolargo glances 4.5.1. Check the vendor advisory for mitigations.

References

• https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da
• https://github.com/nicolargo/glances/releases/tag/v4.5.1
• https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6

Get alerted when CVE-2026-30928 or the next vulnerability affects your stack