CVE-2026-68520: falha de média gravidade em nicolargo glances
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
nicolargo · glancesCVEs relacionadas — nicolargo glances
No mesmo produto, das mais perigosas para as menos.
CVE-2026-30928HIGHGlances Exposes Unauthenticated Configuration SecretsEPSS 1.8%CVE-2026-32596HIGHGlances exposes the REST API without authenticationEPSS 1.6%CVE-2026-33641HIGHGlances Vulnerable to Command Injection via Dynamic Configuration ValuesEPSS 0.9%CVE-2026-32609HIGHGlances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP CredentialsEPSS 0.5%CVE-2026-32633CRITICALGlances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`EPSS 0.5%CVE-2026-68517MEDIUMGlances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the WildcardEPSS 0.5%