CVE-2026-68520
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Glances before 4.5.6 has a vulnerability in as_dict_secure() in glances/config.py that checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests.
Risk Assessment
The risk includes exposure of credentials and usernames, potentially leading to unauthorized access to the monitoring system.
Recommendation
It is recommended to upgrade to version 4.5.6 or later, which includes the fix.
Original NVD description (English source)
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.