CVE-2026-30928: Glances Information Disclosure Vulnerability

CVE-2026-30928 Overview

CVE-2026-30928 is a sensitive data exposure vulnerability in Glances, an open-source cross-platform system monitoring tool. Prior to version 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords.

This information disclosure vulnerability allows unauthenticated remote attackers to retrieve sensitive credentials by simply querying the exposed API endpoint, potentially leading to further compromise of connected systems and services.

Critical Impact

Unauthenticated attackers can access database passwords, API tokens, JWT signing keys, and SSL key passwords from the Glances configuration file via the REST API, enabling lateral movement and broader system compromise.

Affected Products

• Glances versions prior to 4.5.1
• Systems exposing the Glances REST API to untrusted networks
• Environments with sensitive credentials configured in glances.conf

Discovery Timeline

• 2026-03-10 - CVE-2026-30928 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30928

Vulnerability Analysis

The vulnerability exists in the Glances REST API implementation where the /api/4/config endpoint exposes the complete configuration dictionary without filtering sensitive fields. When the configuration file is parsed, it stores all values including credentials for backend integrations. The API endpoint returns this data directly to requesters without any authentication checks or sensitive data redaction.

The weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The Glances configuration file typically contains credentials for various backend services such as InfluxDB, Cassandra, CouchDB, Elasticsearch, and other data stores, as well as authentication tokens for cloud services and monitoring integrations.

An attacker with network access to the Glances web interface can retrieve these credentials without any authentication, as the vulnerable endpoint does not require authorization by default.

Root Cause

The root cause is the lack of sensitive data filtering in the /api/4/config endpoint implementation. The self.config.as_dict() method returns the complete configuration dictionary including all credential fields, passwords, and secret keys without any sanitization or redaction.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a simple HTTP GET request to the /api/4/config endpoint on any Glances instance exposing its REST API.

The exploitation process involves:

1. Discovering a Glances instance with the web server enabled (default port 61208)
2. Sending a GET request to /api/4/config
3. Parsing the JSON response to extract sensitive credentials
4. Using extracted credentials to access connected backend services

The vulnerability is particularly dangerous when Glances is exposed to the internet or untrusted network segments, as no prior access or authentication is required to extract the sensitive configuration data.

Detection Methods for CVE-2026-30928

Indicators of Compromise

• Unusual or repeated HTTP GET requests to /api/4/config endpoint
• Access to Glances API from unexpected IP addresses or network segments
• Evidence of credential misuse on backend services configured in Glances
• Unauthorized access to databases, cloud services, or monitoring platforms using credentials stored in glances.conf

Detection Strategies

• Monitor web server access logs for requests to /api/4/config and /api/*/config endpoints
• Implement network segmentation alerts for external access attempts to Glances API ports (default 61208)
• Audit authentication logs on backend services for unexpected access using credentials stored in Glances configuration
• Deploy web application firewalls (WAF) to detect and block suspicious API enumeration attempts

Monitoring Recommendations

• Enable detailed access logging on Glances web server to capture all API requests with source IP addresses
• Configure SIEM alerts for API endpoint enumeration patterns targeting configuration endpoints
• Monitor for lateral movement indicators using credentials associated with Glances backend integrations
• Implement network traffic analysis to detect data exfiltration from Glances API responses

How to Mitigate CVE-2026-30928

Immediate Actions Required

• Upgrade Glances to version 4.5.1 or later immediately
• Restrict network access to Glances REST API using firewall rules or network segmentation
• Rotate all credentials stored in glances.conf including database passwords, API tokens, and SSL key passwords
• Review access logs for evidence of prior exploitation and investigate any suspicious API access

Patch Information

The vulnerability is fixed in Glances version 4.5.1. The patch implements filtering of sensitive configuration values before returning the configuration data via the API endpoint. Organizations should update to 4.5.1 or later using their preferred package manager or by downloading from the official GitHub Release page.

For additional technical details on the fix, refer to the commit changes and the GitHub Security Advisory GHSA-gh4x-f7cq-wwx6.

Workarounds

• Disable the Glances web server entirely if REST API access is not required by setting --disable-webui flag
• Implement reverse proxy with authentication in front of Glances API endpoints
• Use firewall rules to restrict access to Glances port 61208 to trusted management networks only
• Remove sensitive credentials from glances.conf and use environment variables or external secret management where supported

# Restrict Glances API access using iptables
iptables -A INPUT -p tcp --dport 61208 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 61208 -j DROP

# Alternatively, bind Glances to localhost only
glances -w --bind 127.0.0.1