CVE-2026-68520

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6

Description An issue exists in the as dict secure() function within glances/config.py where the sanitization process only validates option names against a regex pattern and fails to inspect the actual values. This allows unauthenticated users to access sensitive information through the 'GET /api/4/config' and 'GET /api/4/config/ip' API endpoints. Specifically, the public username variable and credentials embedded within the public api variable (such as those in the format https://user:pass@host/) are exposed in full, even though the function is intended to mask sensitive configuration data.

Recommendations Update Glances to version 4.5.6. As a temporary workaround, restrict access to the 'GET /api/4/config' and 'GET /api/4/config/ip' API endpoints.