CVE-2026-30928 Details

A vulnerability in Glances versions prior to 4.5.1 allows the /api/4/config REST API endpoint to expose the entire parsed configuration file, glances.conf, without filtering sensitive information. This unfiltered data includes credentials for backend services such as database passwords, API tokens, JWT signing keys, and SSL key passwords. The issue arises because the as_dict() method in the configuration file's parser returns all data without any redaction of sensitive keys. The vulnerability can be exploited by accessing the API endpoint over the network, which could lead to a full compromise of the affected infrastructure by exposing critical database credentials.

Users are advised to upgrade to Glances version 4.5.1, which addresses this vulnerability by implementing a secure version of the configuration API that filters sensitive information. Instructions for upgrading are available in the Glances release notes.