CVE-2026-32609: Glances Incomplete Secrets Redaction Vulnerability Exposes Sensitive Information
Summary
CVE-2026-32609: The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the /api/v4/config endpoints by introducing as_dict_secure() redaction. Affects glances versions < 4.5.2. Fixed in 4.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Glances is a real-time monitoring tool for system performance, providing insights into CPU, memory, disk, and network usage. It is designed for both local and remote monitoring, offering a web-based interface for easy access. However, it has a vulnerability that allows unauthorized access to sensitive configuration details when certain endpoints are accessed without authentication.
Vulnerability Detail
The vulnerability arises from the incomplete redaction of sensitive information in the /api/v4/args and /api/v4/args/{item} endpoints. These endpoints expose critical command-line arguments, including password hashes, SNMP credentials, and configuration file paths, when Glances is run without a password. This can lead to unauthorized access to sensitive data, enabling attackers to perform network reconnaissance or offline password cracking. The issue was not addressed in a previous fix that secured other endpoints, leaving these endpoints vulnerable to exploitation.
How To Fix
Minimum fixed version
4.5.2
This is the first release that contains the fix.
pip install --upgrade "glances==4.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that Glances is always run with the --password option to enable authentication, thus preventing unauthorized access to sensitive endpoints.
Conclusion
The CVE-2026-32609 vulnerability in Glances poses significant risks by exposing sensitive information through unauthenticated endpoints. It is crucial to update to the patched version 4.5.2 or later and implement recommended workarounds to secure your application.
See every vulnerability recorded for glances →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability exposes sensitive information such as password hashes, SNMP community strings, SNMP authentication keys, and configuration file paths.
Yes, you can mitigate the risk by running Glances with the --password option to enable authentication, which will restrict access to sensitive endpoints.
The potential consequences include unauthorized access to sensitive configuration details, offline password cracking, and lateral movement within the network.
References
Related vulnerabilities
Recent vulnerabilities recorded for glances.
