7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32609

CVE-2026-32609: Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials

Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the /api/v4/config endpoints by introducing as_dict_secure() redaction. However, the /api/v4/args and /api/v4/args/{item} endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via vars(self.args), which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without --password (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32609

CVE-2026-32609:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Glances	pip	< 4.5.2	4.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Glances REST API, where the /api/4/args and /api/4/args/{item} endpoints exposed sensitive configuration data. These endpoints are implemented by the _api_args and _api_args_item methods within the GlancesRestfulApi class. The core issue was that these methods directly used vars(self.args) to serialize and return the application's command-line arguments without any sanitization. When Glances is run in its default mode without a password, these endpoints are unauthenticated. This allows any user on the network to retrieve sensitive information, including SNMP community strings, authentication keys, and password hashes for offline cracking. The patch, commit ff14eb9780ee10ec018c754754b1c8c7bfb6c44f, addresses this by introducing a _sanitize_args helper method that redacts known sensitive keys from the arguments before they are returned. The vulnerable functions, _api_args and _api_args_item, were modified to use this new sanitization function, thus mitigating the information disclosure.

Vulnerable functions

GlancesRestfulApi._api_args

glances/outputs/glances_restful_api.py

This function was vulnerable because it directly exposed all command-line arguments by returning `vars(self.args)`. When Glances is run without a password (the default configuration), this API endpoint is unauthenticated, allowing an attacker to retrieve sensitive information such as SNMP credentials and password hashes.

GlancesRestfulApi._api_args_item

glances/outputs/glances_restful_api.py

This function was vulnerable because it returned a specific command-line argument requested by the user from `vars(self.args)`. This allowed an attacker to directly query for sensitive keys like 'password' or 'snmp_auth'. In the default unauthenticated mode, this provides direct access to secrets. Even in authenticated mode, it would leak the password hash.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.