Executive brief
Glances, a system monitoring tool, exposes sensitive credentials via its REST API configuration endpoint to unauthenticated users. The application provides a function designed to sanitize configuration for public access, but it only masks certain key names and fails to detect embedded credentials in URL values or mask username fields. An attacker without authentication can retrieve plaintext usernames and embedded passwords from API URLs by requesting the config endpoint.
Technical details
The vulnerability is an information exposure flaw (CWE-200) in the as_dict_secure() function in glances/config.py. The function uses a regex pattern to mask values by matching sensitive KEY names (password, token, secret, api_key, apikey, ssl_keyfile) but never inspects the actual VALUE content. This allows credentials embedded in URLs (e.g., https://user:pass@host/) and plaintext usernames stored in configuration keys like 'public_api' and 'public_username' to be returned unmasked via GET /api/4/config. The vulnerable code path is triggered when the REST API is accessed without authentication (--password flag not set), which is the default configuration. The attacker requires only network access to the unauthenticated REST API endpoint; no credentials or user interaction is needed. A patch is available in version 4.5.6.
Affected products
- nicolargo glances < 4.5.6
Timeline
- 2026-07-28: disclosed: Vulnerability discovered and verified via Docker deployment
- 2026-08-01: patched: Fixed in version 4.5.6
- 2026-08-17: advisory: Published to GitHub Advisory Database