Most recent entries from all

BREW-glances-CVE-2026-68520 — Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.

CVE-2026-68520 — Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Affected: nicolargo glances

GHSA-4h34-v6r8-mmjc — Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Affected: PyPI: glances

## Summary

Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by '********'". However, the implementation only checks KEY names against a regex pattern and never inspects VALUE content. The documented `[ip]` config section supports `public_api` (URL), `public_username` (login), and `public_password` (password). While `public_password` is correctly masked, both `public_api` (when containing embedded credentials like `https://user:pass@host/`) and `public_username` are returned in full to unauthenticated users via `GET /api/4/config`.

## Affected Versions

Glances latest (Docker: `nicolargo/glances:latest`)

## Root Cause

def as_dict_secure(self): """Return a sanitised copy of the configuration dict. Intended for unauthenticated API access. - Sensitive keys in remaining sections are replaced by '********'. """ sanitized = {} for section, options in self.as_dict().items(): if section in _SECURE_BLOCKED_SECTIONS: continue sanitized[section] = { key: "********" if _SECURE_SENSITIVE_KEY_RE.search(key) else value for key, value in options.items() } return sanitized ```

In `…