CVE-2026-30928: Glances Exposes Unauthenticated Configuration Secrets
Summary
CVE-2026-30928: Glances Exposes Unauthenticated Configuration Secrets. Affects glances versions < 4.5.1. Fixed in 4.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Glances is a cross-platform monitoring tool that provides a comprehensive overview of system performance and resource usage. It offers real-time monitoring of various system metrics, including CPU, memory, disk I/O, and network usage. The tool is designed for ease of use and can be accessed via a web interface or command line. However, a significant vulnerability has been identified that exposes sensitive configuration data without authentication, potentially compromising the security of systems using Glances.
Vulnerability Detail
The vulnerability arises from the /api/4/config REST API endpoint, which returns the entire Glances configuration file without filtering sensitive information. The as_dict() method in config.py retrieves all configuration settings, including credentials for backend services such as database passwords, API tokens, and SSL key passwords. This lack of filtering allows unauthorized users to access sensitive data, leading to potential full infrastructure compromise.
How To Fix
Latest published version: 4.5.8 as of 23 Oct 2026
pip install --upgrade "glances==4.5.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.1
This is the first release that contains the fix.
pip install --upgrade "glances==4.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Glances API by implementing network-level controls, such as firewalls or VPNs, to limit who can access the API endpoint. Additionally, ensure that the Glances server is not publicly accessible.
Conclusion
The Glances vulnerability CVE-2026-30928 poses a serious risk by exposing sensitive configuration data through an unauthenticated API endpoint. It is crucial for users to update to the patched version 4.5.1 to mitigate this risk. Implementing network-level controls can serve as a temporary measure until the update is applied.
See every vulnerability recorded for glances →
FAQ
The vulnerability can lead to unauthorized access to sensitive configuration data, including database credentials and API tokens, potentially resulting in a full infrastructure compromise.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
Yes, the vulnerability has been patched in Glances version 4.5.1. It is recommended to update to this version or later.
If immediate updates are not possible, implement network-level access controls to restrict access to the Glances API as a temporary workaround.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for glances.
