CVE-2026-68520 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Unauthenticated attackers can retrieve sensitive credentials from API endpoints due to insufficient sanitization in Glances configuration exports.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68520?
CVE-2026-68520 is a medium-severity vulnerability in nicolargo glances, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.
Weakness: CWE-200
Which versions are affected by CVE-2026-68520?
3 open source packages ship an affected version, including glances.
| Package | Affected | Fixed in |
|---|---|---|
glances PyPI | All versions | 4.5.6 |
glances PyPI | All versions | 4.5.6 |
glances PyPI | All versions | 4.5.6 |
How do I fix CVE-2026-68520?
Upgrade glances to 4.5.6 or later.
Is CVE-2026-68520 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-68520 exists.
Sources
Also known as DEBIAN-CVE-2026-68520, GHSA-4h34-v6r8-mmjc, PYSEC-2026-3664, UBUNTU-CVE-2026-68520.