Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.

Affected: PyPI: Glances

### Summary Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client.

### Details Root Cause: Authentication is optional and disabled by default. When no password is provided, the API router initializes without authentication dependency, and the server binds to 0.0.0.0 exposing all endpoints.

Affected Code: - File: `glances/outputs/glances_restful_api.py`, lines 259-272

```python if self.args.password: self._password = GlancesPassword(username=args.username, config=config) if JWT_AVAILABLE: jwt_secret = config.get_value('outputs', 'jwt_secret_key', default=None) jwt_expire = config.get_int_value('outputs', 'jwt_expire_minutes', default=60) self._jwt_handler = JWTHandler(secret_key=jwt_secret, expire_minutes=jwt_expire) logger.info(f"JWT authentication enabled (token expiration: {jwt_expire} minutes)") else: self._jwt_handler = None logger.info("JWT authentication not available (python-jose not installed)") else: self._password = None # NO AUTHENTICATION BY DEFAULT self._jwt_handler = None ```

- File: `glances/outputs/glances_restful_api.py`, lines 477-480

```python if self.args.password: router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)]) else: router = APIRouter(prefix=…

glances-common-4.5.2-1.1 on GA media

Affected: PyPI: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.

Affected: Ubuntu:Pro:16.04:LTS: glances, Ubuntu:Pro:18.04:LTS: glances, Ubuntu:Pro:20.04:LTS: glances, Ubuntu:22.04:LTS: glances, Ubuntu:24.04:LTS: glances, Ubuntu:25.10: glances, Ubuntu:26.04:LTS: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.