8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30928

CVE-2026-30928: Glances Exposes Unauthenticated Configuration Secrets

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30928

CVE-2026-30928:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
glances	pip	< 4.5.1	4.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unauthenticated exposure of sensitive configuration secrets in the Glances monitoring tool. The root cause lies in the Config.as_dict method, which reads the entire glances.conf file, including database passwords, API tokens, and other credentials, and returns it as a raw dictionary. This sensitive data is then exposed through several unauthenticated API endpoints (_api_config, _api_config_section, _api_config_section_item) handled by the GlancesRestfulApi class. If Glances is started in web server mode (-w) without a master password, these endpoints are accessible to any user on the network, allowing them to retrieve all secrets. The patch addresses this by creating a new, sanitized method Config.as_dict_secure that redacts sensitive information. The API endpoints are modified to use this secure method for unauthenticated requests, while the original as_dict method is only used for authenticated sessions, thus preventing the information leak.

Vulnerable functions

Config.as_dict

glances/config.py

This function is the root cause of the vulnerability. It reads and returns the entire application configuration, including sensitive credentials, without any redaction or filtering. Its output is directly exposed through an unauthenticated API endpoint.

GlancesRestfulApi._api_config

glances/outputs/glances_restful_api.py

This function defines the `/api/4/config` REST API endpoint. Before the patch, it unconditionally called the insecure `self.config.as_dict()` method and returned the sensitive configuration data to any client, as authentication was not enforced by default.

GlancesRestfulApi._api_config_section

glances/outputs/glances_restful_api.py

This function, part of the REST API, retrieves a specific section of the configuration. It was vulnerable because it used the insecure `self.config.as_dict()` method to fetch the data, allowing unauthenticated users to access potentially sensitive configuration sections.

GlancesRestfulApi._api_config_section_item

glances/outputs/glances_restful_api.py

This function, part of the REST API, retrieves a specific key-value pair from the configuration. It was vulnerable because it used the insecure `self.config.as_dict()` method, allowing unauthenticated users to query for specific secrets like 'password' or 'token'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.