Most recent entries from all

bdu:2026-07330

BREW-glances-CVE-2026-32609 — Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.

EUVD-2026-276454

fkie_cve-2026-32609

GHSA-cvwp-r2g2-j824 — Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

Affected: PyPI: Glances

## Summary

The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication.

## Details

The secrets exposure fix (GHSA-gh4x, commit 5d3de60) modified three config-related endpoints to use `as_dict_secure()` when no password is configured:

```python # glances/outputs/glances_restful_api.py:1168 (FIXED) args_json = self.config.as_dict() if self.args.password else self.config.as_dict_secure() ```

However, the `_api_args` and `_api_args_item` endpoints were not part of this fix and still return all arguments without any sanitization:

```python # glances/outputs/glances_restful_api.py:1222-1237 def _api_args(self): try: # Get the RAW value of the args dict # Use vars to convert namespace to dict args_json = vars(self.args) except Exception as e: raise HTTPException(status.HTTP_404_NOT_FOUND, f"Cannot get args ({str(e)})")

return GlancesJSONResponse(args_json) ```

And the item-specific endpoint:…

openSUSE-SU-2026:10415-1 — glances-common-4.5.2-1.1 on GA media

glances-common-4.5.2-1.1 on GA media

PYSEC-2026-2168

Affected: PyPI: glances

UBUNTU-CVE-2026-32609

Affected: Ubuntu:Pro:16.04:LTS: glances, Ubuntu:Pro:18.04:LTS: glances, Ubuntu:Pro:20.04:LTS: glances, Ubuntu:22.04:LTS: glances, Ubuntu:24.04:LTS: glances, Ubuntu:25.10: glances, Ubuntu:26.04:LTS: glances