CVE-2026-68520
Description
A flaw was found in Glances, an open-source system monitoring tool. A remote unauthenticated attacker could exploit a vulnerability in the as_dict_secure() function, which incorrectly handles option names. This flaw leads to the exposure of sensitive information, including usernames and credentials embedded in public API values. This information can be accessed through unauthenticated GET requests to the /api/4/config and /api/4/config/ip endpoints, resulting in information disclosure.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, restrict network access to the Glances API. Configure firewall rules to limit connections to the Glances service port (default 61208) only from trusted hosts or networks. If remote access is not required, configure the Glances service to bind to the localhost interface. After implementing network restrictions or configuration changes, ensure the Glances service is restarted to apply the changes.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
