CVE-2026-68520: 
Python vulnerability analysis and mitigation

CVE-2026-68520 is a credential disclosure vulnerability in Glances, an open-source cross-platform system monitoring tool, caused by an incomplete sanitization bypass in the as_dict_secure() function. The flaw allows unauthenticated attackers to retrieve sensitive credentials — including usernames and passwords embedded in API URLs — via unauthenticated HTTP GET requests to /api/4/config or /api/4/config/ip. All versions of Glances prior to 4.5.6 are affected. The vulnerability was discovered on 2026-07-28 by researcher 0xTodor and published to the GitHub Advisory Database on 2026-08-17. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is an incomplete key-name-only regex filter in glances/config.py within the as_dict_secure() function, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The sensitive key regex _SECURE_SENSITIVE_KEY_RE matched patterns like password, token, secret, api_key, apikey, and ssl_keyfile, but did not include username or login, and critically never inspected the content of values. As a result, the [ip] config section's public_username field was returned in plaintext, and public_api values containing embedded credentials in URL form (e.g., https://user:pass@host/) were also fully exposed. Exploitation requires only that Glances runs in web server mode without the --password flag (the default no-auth configuration) and that the [ip] section contains a public_api URL with embedded credentials or a public_username value (Github Advisory, Patch Commit).

An unauthenticated remote attacker can call GET /api/4/config or GET /api/4/config/ip to retrieve plaintext usernames and credential-bearing URLs (containing embedded user:password pairs) configured for remote APIs in the Glances [ip] section. The confidentiality impact is limited to the exposed configuration credentials, with no integrity or availability impact. However, disclosed credentials could be reused to access downstream systems or APIs, enabling lateral movement beyond the Glances host itself (Github Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of active in-the-wild exploitation as of the advisory date. However, the NVD SSVC assessment classifies the vulnerability as automatable with a PoC exploitation status, indicating the attack is trivially scriptable with a single unauthenticated HTTP GET request. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Glances instances running in web server mode (default port 61208 or custom port) using tools like Shodan, Censys, or direct network scanning. Look for Glances versions prior to 4.5.6.
2. Verify no-auth mode: Confirm the target is running without the --password flag by attempting to access the API without credentials (e.g., curl http://<target>:<port>/api/4/config).
3. Request the config endpoint: Send an unauthenticated HTTP GET request to the vulnerable endpoint:

   curl -s "http://<target>:<port>/api/4/config/ip"

4. Extract credentials: Parse the JSON response for public_username (plaintext login name) and public_api (URL potentially containing embedded user:password@host credentials). Example response:

   {"public_api": "https://admin:secret123@ipv4.ipleak.net/json/", "public_username": "myname", "public_password": "********"}

5. Leverage disclosed credentials: Use the extracted credentials to authenticate against the referenced remote API or other services where the credentials may be reused (Github Advisory).

• Network: Unauthenticated HTTP GET requests to /api/4/config or /api/4/config/ip from external or unexpected IP addresses; repeated automated requests to these endpoints in short succession suggesting scripted enumeration.
• Logs: Web server access logs showing GET /api/4/config or GET /api/4/config/ip requests with HTTP 200 responses from unauthenticated clients; absence of an Authorization header in such requests.
• Process/Configuration: Glances running with the -w (web server) flag and without --password; presence of public_api with embedded credentials (user:pass@) or public_username set in glances.conf under the [ip] section.

Upgrade Glances to version 4.5.6 or later, which introduces a secure_option() function that both expands the sensitive key regex (adding username, \buser\b, and login) and inspects string values for embedded URL credentials using a separate regex pattern (Glances Release, Patch Commit). As an interim workaround, restrict network access to the Glances API port (default 61208) to trusted hosts only using firewall rules, or enable authentication with the --password flag. Additionally, audit existing Glances configurations for credentials embedded in public_api URLs and rotate any credentials that may have been exposed to untrusted networks (Github Advisory).