CVE-2026-68520: Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure() in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
glancesto a version that resolves this vulnerability.Fixed in 4.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68520?
CVE-2026-68520 has a medium severity rating of 5.3.
What type of vulnerability is CVE-2026-68520?
CVE-2026-68520 is categorized as an information leak (CWE-200).
How do I fix CVE-2026-68520?
To mitigate CVE-2026-68520, upgrade Glances to version 4.5.6 or later.
What does CVE-2026-68520 affect?
CVE-2026-68520 affects the Glances monitoring tool prior to version 4.5.6.
What is exposed in CVE-2026-68520?
CVE-2026-68520 leaks public_username and credentials through API responses in unauthenticated requests.