CVE-2026-30928: falha de alta gravidade em nicolargo glances
Glances Exposes Unauthenticated Configuration Secrets
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 8.7epss 1.8%
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
nicolargo · glancesCVEs relacionadas — nicolargo glances
No mesmo produto, das mais perigosas para as menos.
CVE-2026-32596HIGHGlances exposes the REST API without authenticationEPSS 1.6%CVE-2026-33641HIGHGlances Vulnerable to Command Injection via Dynamic Configuration ValuesEPSS 0.9%CVE-2026-32609HIGHGlances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP CredentialsEPSS 0.5%CVE-2026-32633CRITICALGlances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`EPSS 0.5%CVE-2026-68517MEDIUMGlances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the WildcardEPSS 0.5%CVE-2026-30930HIGHGlances has SQL Injection via Process Names in TimescaleDB ExportEPSS 0.4%