CVE-2026-68520

Published: Aug 17, 2026Modified: Oct 23, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/nicolargo/glances/commit/8d0f8276c2abd2e9d400bd6c84bdfba0dfcab065

Source: security-advisories@github.com

https://github.com/nicolargo/glances/releases/tag/v4.5.6

Source: security-advisories@github.com

https://github.com/nicolargo/glances/security/advisories/GHSA-4h34-v6r8-mmjc

Source: security-advisories@github.com

https://github.com/nicolargo/glances/security/advisories/GHSA-4h34-v6r8-mmjc

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.