PT-2026-24167 · Glance · Glance

Neo-Ai-Engineer + 1 · Published 2026-03-07 · Updated 2026-03-22 · CVE-2026-30928

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.1

Description Glances is a cross-platform system monitoring tool. The '/api/4/config' REST API endpoint returns the entire Glances configuration file (glances.conf) without filtering sensitive values. This configuration file contains credentials for backend services, including database passwords, API tokens, JWT signing keys, and SSL key passwords. The vulnerability stems from the as dict() method in config.py, which iterates through all configuration sections and keys without applying any redaction. The API endpoint lacks authentication when started without a password. Exploitation involves retrieving the configuration file via a simple HTTP request, allowing attackers to extract sensitive information and potentially compromise the entire infrastructure.

Recommendations Glances versions prior to 4.5.1 should be updated to version 4.5.1 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-04356

CVE-2026-30928

GHSA-GH4X-F7CQ-WWX6

Affected Products

Glance

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30928.json · Exploit
• https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6 · Vendor Advisory
• https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da · Patch
• https://cve.org/CVERecord?id=CVE-2026-30928 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-30928 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-30928 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04356 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30928 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gh4x-f7cq-wwx6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30928 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30928 · Security Note
• https://github.com/nicolargo/glances · Note
• https://github.com/nicolargo/glances/releases/tag/v4.5.1 · Note
• https://twitter.com/infoflowcloud/status/2034138112683589970 · Twitter Post