CVE-2026-32609
Last modified
CVE-2026-32609 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. EPSS estimates a 0.50% chance of exploitation in the next 30 days.
Description
Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nicolargo | Glances | < 4.5.2 |
References
- https://github.com/nicolargo/glances/releases/tag/v4.5.2Product, Release Notes
- https://github.com/nicolargo/glances/security/advisories/GHSA-cvwp-r2g2-j824Exploit, Mitigation, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-32609?
How severe is CVE-2026-32609?
How do I fix CVE-2026-32609?
Are you affected by CVE-2026-32609?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST