Executive brief
Glances, a popular system monitoring tool, contains a security flaw where its web-based interface runs without any password protection by default. This allows anyone on the network to view sensitive server details, including running processes and system configurations. Most critically, an attacker can see full command-line arguments for other programs, which often contain sensitive credentials like passwords, API keys, and security tokens.
Technical details
Glances is vulnerable to information disclosure because its REST API, when enabled via the web server mode (-w), does not enforce authentication by default. The root cause is located in 'glances/outputs/glances_restful_api.py', where the API router is initialized without authentication dependencies if no password is provided, and the server binds to all interfaces (0.0.0.0). A remote, unauthenticated attacker can query endpoints such as /api/4/processlist to retrieve full command-line arguments of all running processes. This frequently results in the exposure of sensitive credentials (passwords, tokens, API keys) passed as CLI arguments. The vulnerability is patched in version 4.5.2.
Affected products
- nicolargo Glances < 4.5.2
Timeline
- 2026-03-14: disclosed
- 2026-03-16: advisory: GitHub Advisory published
- 2026-03-18: other: NVD published