Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-68520 in Glances stems from insufficient sanitization of configuration and argument values when exposed via unauthenticated API endpoints (/api/4/config and /api/4/args). The core issue was that the existing sanitization logic primarily focused on redacting sensitive keys but failed to inspect the values associated with these keys or other keys for embedded sensitive information, such as credentials in URL strings. Additionally, the regex used for identifying sensitive keys was incomplete, specifically missing 'username' and 'user'.
The analysis of the provided commit 8d0f8276c2abd2e9d400bd6c84bdfba0dfcab065 clearly shows the introduction of a new function secure_option and its integration into two key areas:
glances.config.as_dict_secure: This function is responsible for preparing a sanitized dictionary of configuration options for unauthenticated API access. The patch modifies this function to iterate through all configuration options and apply secure_option to each key-value pair. This ensures that not only are sensitive keys redacted, but also that values (like URLs) are checked for embedded credentials. The _SECURE_SENSITIVE_KEY_RE regex was also expanded to cover more sensitive key names like 'username' and 'user'.
glances.outputs.glances_restful_api.GlancesRestfulApi._sanitize_args: This method handles the sanitization of command-line arguments. The patch updates this method to also use secure_option to process argument values, thereby preventing the leakage of sensitive data that might be present in arguments, especially when the Glances instance is running without authentication.
Exploitation would involve an unauthenticated attacker making a GET request to /api/4/config or /api/4/config/ip (or potentially /api/4/args), which would return the configuration or arguments with sensitive information (like public_username or credentials embedded in public_api URLs) unredacted due to the lack of value-level sanitization and the incomplete key-based redaction in the vulnerable versions. The identified functions are precisely where this insufficient sanitization occurred.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| glances | pip | < 4.5.6 | 4.5.6 |
