CVE-2026-30928

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30928
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da Patch
https://github.com/nicolargo/glances/releases/tag/v4.5.1 Product
https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*
History

17 Mar 2026, 16:20

Type Values Removed Values Added
Summary
  • (es) Glances es una herramienta de monitorización de sistemas multiplataforma de código abierto. Antes de la versión 4.5.1, el endpoint de la API REST /api/4/config devuelve el archivo de configuración de Glances (glances.conf) completo y parseado a través de self.config.as_dict() sin filtrar valores sensibles. El archivo de configuración contiene credenciales para todos los servicios de backend configurados, incluyendo contraseñas de bases de datos, tokens de API, claves de firma JWT y contraseñas de claves SSL. Esta vulnerabilidad está corregida en la versión 4.5.1.
References () https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da - () https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da - Patch
References () https://github.com/nicolargo/glances/releases/tag/v4.5.1 - () https://github.com/nicolargo/glances/releases/tag/v4.5.1 - Product
References () https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6 - () https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6 - Exploit, Vendor Advisory
CPE cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Nicolargo glances
Nicolargo

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-03-17 16:20

NVD link : CVE-2026-30928

Mitre link : CVE-2026-30928

CVE.ORG link : CVE-2026-30928

JSON object : View

Products Affected

nicolargo

  • glances
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor