CVE-2026-68520: Glances Information Disclosure Vulnerability

CVE-2026-68520 Overview

Glances is an open-source cross-platform system monitoring tool. Versions prior to 4.5.6 contain an information disclosure vulnerability in the as_dict_secure() function inside glances/config.py. The function only inspects configuration option names when deciding what to redact. It does not scan option values. As a result, public_username and credentials embedded inside public_api URL values (in the form scheme://user:password@host) are exposed through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. The issue is fixed in Glances 4.5.6. This weakness is tracked as [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Any remote attacker with network access to the Glances REST API can retrieve embedded credentials without authentication.

Affected Products

Glances open-source system monitoring tool
All versions prior to 4.5.6
Deployments exposing the Glances REST API (/api/4/config endpoints)

Discovery Timeline

2026-08-17 - CVE-2026-68520 published to NVD
2026-08-17 - Last updated in NVD database
Patch released - Glances v4.5.6 with fix in commit 8d0f8276
Advisory published - GHSA-4h34-v6r8-mmjc

Technical Details for CVE-2026-68520

Vulnerability Analysis

Glances exposes a REST API that includes configuration introspection endpoints. The as_dict_secure() helper in glances/config.py is intended to return the loaded configuration with sensitive fields redacted before serialization. The redaction logic uses a regular expression against option keys only. Values are returned verbatim.

Operators frequently place credentials inside URL-shaped configuration values, for example public_api = https://user:token@example.com/endpoint. The key public_api does not match the sensitive-key pattern, so the entire URL, including the embedded credentials, is emitted in the API response. The public_username option is similarly leaked because the key name does not match the sensitive pattern.

Because the affected endpoints do not enforce authentication, the disclosure is reachable by anyone with network access to the Glances web server. The EPSS score is 0.237% (percentile 14.95) as of 2026-08-23.

Root Cause

Attack Vector

An unauthenticated remote attacker sends GET /api/4/config or GET /api/4/config/ip to a reachable Glances instance and parses the JSON response for public_username or URL values containing an user:password@ component.

python

# Patch excerpt: glances/config.py
# Key name patterns redacted in any section
# Note: `\buser\b` only matches a standalone `user` key, so the CPU/load
# `user_careful`, `user_warning`... thresholds stay visible (they are not credentials).
_SECURE_SENSITIVE_KEY_RE = re.compile(
    r"password|token|secret|api_key|apikey|ssl_keyfile|username|\buser\b|login",
    re.IGNORECASE,
)

# Credentials embedded in an URL value (scheme://user:password@host)
_SECURE_URL_CREDENTIALS_RE = re.compile(r"(?<=://)[^/?#@\s]+@")


def secure_option(key, value):
    """Return the sanitised value of a configuration option or a command line argument.

    A sensitive key is fully redacted, otherwise only the credentials
    embedded in an URL value are redacted. Non string values (boolean flags,
    ports, refresh rates...) can not carry a credential and are returned as is.
    """
    if not isinstance(value, str):
        return value
    if _SECURE_SENSITIVE_KEY_RE.search(key):
        return "********"
    return _SECURE_URL_CREDENTIALS_RE.sub("********@", value)

Source: nicolargo/glances commit 8d0f8276. The patch expands the key regex and adds a value-level regex that rewrites user:password@ sequences inside URL values to ********@.

Detection Methods for CVE-2026-68520

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/4/config or /api/4/config/ip from external or unexpected internal sources.
Web server or reverse proxy access logs showing repeated enumeration of the Glances API paths.
Outbound authentication failures on services referenced by public_api URLs, indicating attacker replay of leaked credentials.

Detection Strategies

Inspect Glances server access logs for requests to the /api/4/config family of endpoints and correlate with source IP allowlists.
Fingerprint deployed Glances versions across the estate and flag any instance reporting a version earlier than 4.5.6.
Search configuration files for public_api values containing embedded credentials in scheme://user:password@host form.

Monitoring Recommendations

Alert on any Glances API response body containing :// followed by a credential pattern in outbound proxy inspection.
Monitor usage of credentials referenced in public_api values for anomalous source IPs or geographies.
Track network exposure of Glances TCP ports (default 61208) at perimeter and cloud security-group layers.

How to Mitigate CVE-2026-68520

Immediate Actions Required

Upgrade Glances to version 4.5.6 or later on every host running the web server or REST API.
Rotate any credentials that were embedded in public_api URLs or exposed via public_username, treating them as disclosed.
Restrict network reachability of the Glances API to trusted management networks using firewalls or reverse-proxy authentication.

Patch Information

The fix is included in Glances v4.5.6. It introduces a new secure_option() helper that redacts sensitive keys and rewrites credentials embedded in URL values. See the GitHub Security Advisory GHSA-4h34-v6r8-mmjc for the vendor description and the patch commit for the code change.

Workarounds

Disable the Glances web server (glances -w) on hosts where remote monitoring is not required.
Place Glances behind a reverse proxy that enforces authentication and blocks /api/4/config and /api/4/config/ip from untrusted networks.
Remove inline credentials from configuration and load them from environment variables or a secrets manager where supported.

bash

# Bind Glances to loopback only and require an authenticated reverse proxy
glances -w --bind 127.0.0.1 --disable-plugin all --username --password

# Example nginx location block to deny the vulnerable endpoints
# location ~ ^/api/4/config(/ip)?$ { return 403; }