CVE-2026-32609: 
Python vulnerability analysis and mitigation

CVE-2026-32609 is an incomplete secrets redaction vulnerability in Glances, an open-source cross-platform system monitoring tool, where the /api/v4/args and /api/v4/args/{item} REST API endpoints expose sensitive runtime configuration — including SNMP credentials, password hashes, usernames, and file paths — without proper sanitization. It affects all Glances versions prior to 4.5.2 and was disclosed by the project maintainer on March 14, 2026, with NVD publication on March 18, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is an incomplete application of a prior security fix (GHSA-gh4x, commit 5d3de60), which introduced as_dict_secure() redaction for /api/v4/config endpoints but left the _api_args and _api_args_item handlers returning the raw vars(self.args) namespace without any sanitization. When Glances is launched without the --password flag (the common default), the API router is instantiated without any authentication dependency, making these endpoints fully unauthenticated and accessible to any network peer. The exposed namespace includes password (salt + pbkdf2_hmac SHA-256 hash with 100,000 iterations), snmp_community, snmp_user, snmp_auth, conf_file, and username fields (GitHub Advisory, Patch Commit).

An unauthenticated remote attacker can enumerate SNMP community strings, SNMPv3 authentication keys, usernames, configuration file paths, and all runtime arguments from any Glances instance running without password protection, enabling immediate lateral movement to other network devices monitored via SNMP. When authentication is enabled, an authenticated user can retrieve the pbkdf2_hmac password hash for offline brute-force cracking. Combined with a separate default CORS misconfiguration (CVE-2026-32610), these secrets can also be exfiltrated cross-origin by a malicious website visited by a user on the same network (GitHub Advisory).

A proof-of-concept exploit consisting of simple curl commands against the /api/4/args and /api/4/args/{item} endpoints is publicly documented in the official security advisory, requiring no authentication and no special tooling (GitHub Advisory). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.15% (0.082% per GitHub Advisory), placing it in the 24th percentile for exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing or internal Glances web server instances (default port 61208) using tools like Shodan, Censys, or nmap targeting port 61208.
2. Verify unauthenticated access: Confirm the instance is running without password protection by issuing a simple HTTP GET request: curl -s http://<target>:61208/api/4/args | python -m json.tool
3. Enumerate sensitive fields: Extract specific credentials using the item endpoint: curl -s http://<target>:61208/api/4/args/snmp_community and curl -s http://<target>:61208/api/4/args/snmp_auth to retrieve SNMP community strings and authentication keys.
4. Retrieve password hash (authenticated scenario): If authentication is enabled, use valid credentials to retrieve the password hash: curl -s -u admin:knownpassword http://<target>:61208/api/4/args/password — the response contains the salt$pbkdf2_hmac hash.
5. Offline cracking: Feed the retrieved hash into a tool such as Hashcat or John the Ripper to recover the plaintext password via brute-force or dictionary attack.
6. Lateral movement: Use the recovered SNMP community strings and SNMPv3 keys to query or manipulate other network devices monitored by the Glances instance (GitHub Advisory).

• Network: Unexpected HTTP GET requests to /api/4/args or /api/4/args/<item> (e.g., snmp_community, snmp_auth, password) from external or untrusted IP addresses on port 61208.
• Network: Unusual SNMP queries to monitored network devices originating from unfamiliar hosts shortly after Glances API access, potentially indicating credential reuse.
• Logs: Glances web server access logs showing repeated or automated requests to /api/4/args endpoints, particularly from non-local IP addresses.
• Logs: Access log entries for /api/4/args/password from authenticated sessions not associated with known administrative users.

Upgrade Glances to version 4.5.2 or later, which introduces a _sanitize_args() method that redacts sensitive fields (password, snmp_community, snmp_user, snmp_auth, conf_file, username) from unauthenticated API responses and always redacts the password hash even for authenticated users (Glances v4.5.2 Release, Patch Commit). As an interim workaround, enable password authentication using the --password flag to restrict API access, and apply firewall rules or network segmentation to limit access to port 61208 to trusted hosts only. Additionally, review and rotate any SNMP community strings and authentication keys that may have been exposed on monitored network devices (GitHub Advisory).

The vulnerability was reported by a researcher credited as "offset" in the official advisory and was addressed by maintainer nicolargo in the same-day v4.5.2 release alongside seven other security fixes (Glances v4.5.2 Release). Brief community discussion was observed on Mastodon and Bluesky, and the issue was tracked by Red Hat's security team via Bugzilla (Red Hat Bugzilla). Coverage was also noted on security aggregation sites including infinitsec.net and exploit-intel.com shortly after disclosure.