Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.

Affected: PyPI: glances

## Summary

Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by '********'". However, the implementation only checks KEY names against a regex pattern and never inspects VALUE content. The documented `[ip]` config section supports `public_api` (URL), `public_username` (login), and `public_password` (password). While `public_password` is correctly masked, both `public_api` (when containing embedded credentials like `https://user:pass@host/`) and `public_username` are returned in full to unauthenticated users via `GET /api/4/config`.

## Affected Versions

Glances latest (Docker: `nicolargo/glances:latest`)

## Root Cause

In `glances/config.py`, `as_dict_secure()`: ```python _SECURE_SENSITIVE_KEY_RE = re.compile(r"password|token|secret|api_key|apikey|ssl_keyfile", re.IGNORECASE)

def as_dict_secure(self): """Return a sanitised copy of the configuration dict. Intended for unauthenticated API access. - Sensitive keys in remaining sections are replaced by '********'. """ sanitized = {} for section, options in self.as_dict().items(): if section in _SECURE_BLOCKED_SECTIONS: continue sanitized[section] = { key: "********" if _SECURE_SENSITIVE_KEY_RE.search(key) else value for key, value in options.items() } return sanitized ```

In `…

glances-common-4.5.6-1.1 on GA media

Affected: PyPI: glances

## Summary

Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by '********'". However, the implementation only checks KEY names against a regex pattern and never inspects VALUE content. The documented `[ip]` config section supports `public_api` (URL), `public_username` (login), and `public_password` (password). While `public_password` is correctly masked, both `public_api` (when containing embedded credentials like `https://user:pass@host/`) and `public_username` are returned in full to unauthenticated users via `GET /api/4/config`.

## Affected Versions

Glances latest (Docker: `nicolargo/glances:latest`)

## Root Cause

In `glances/config.py`, `as_dict_secure()`: ```python _SECURE_SENSITIVE_KEY_RE = re.compile(r"password|token|secret|api_key|apikey|ssl_keyfile", re.IGNORECASE)

def as_dict_secure(self): """Return a sanitised copy of the configuration dict. Intended for unauthenticated API access. - Sensitive keys in remaining sections are replaced by '********'. """ sanitized = {} for section, options in self.as_dict().items(): if section in _SECURE_BLOCKED_SECTIONS: continue sanitized[section] = { key: "********" if _SECURE_SENSITIVE_KEY_RE.search(key) else value for key, value in options.items() } return sanitized ```

In `…

Affected: Ubuntu:Pro:16.04:LTS: glances, Ubuntu:Pro:18.04:LTS: glances, Ubuntu:Pro:20.04:LTS: glances, Ubuntu:22.04:LTS: glances, Ubuntu:24.04:LTS: glances, Ubuntu:26.04:LTS: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.