Unauthenticated Information Disclosure in Glances by Nicolargo

CVE-2026-32609

What is CVE-2026-32609?

Glances, an open-source system monitoring tool, has a vulnerability that allows unauthenticated users to access sensitive configuration information through the /api/v4/args and /api/v4/args/{item} endpoints. Despite the fix for unauthenticated configuration secrets in the /api/v4/config endpoint, these specific endpoints remain vulnerable, exposing critical data such as password hashes and SNMP community strings to anyone without authentication. Users are encouraged to upgrade to version 4.5.2, which addresses these issues comprehensively.

References