Log in Start free

Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M

CVE-2026-30928Glances Exposes Unauthenticated Configuration Secrets

High 8.7

In plain English

A high-severity information exposure in glances from nicolargo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)1.8%top 21.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei

Official description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13glancesno fix listedDEBIAN-CVE-2026-30928
Debian:14glances4.5.1+dfsg-1DEBIAN-CVE-2026-30928
PyPIglances4.5.1GHSA-gh4x-f7cq-wwx6
PyPIglances4.5.1PYSEC-2026-2164
Ubuntu:22.04:LTSglancesno fix listedUBUNTU-CVE-2026-30928
Ubuntu:24.04:LTSglancesno fix listedUBUNTU-CVE-2026-30928
Ubuntu:25.10glancesno fix listedUBUNTU-CVE-2026-30928
Ubuntu:26.04:LTSglancesno fix listedUBUNTU-CVE-2026-30928
Ubuntu:26.10glancesno fix listedUBUNTU-CVE-2026-30928

Affected products (as reported)

VendorProductVersions
nicolargo glances < 4.5.1

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References