CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in public_api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This issue is fixed in 4.5.6.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.24% chance of exploitation in the next 30 days, 15th percentile

Published

2026-08-17

Proof-of-concept exploits (1)

• advisories/GHSA-4h34-v6r8-mmjc

References

• CVE Record
• NVD entry

Related

• CVE-2026-68519
• CVE-2026-6854
• CVE-2026-68518
• CVE-2026-6857
• CVE-2026-68517
• CVE-2026-6858