CVE-2026-32609 | nicolargo glances up to 4.5.1 Endpoint /api/v4/config as_dict_secure information disclosure

VDB-351537 · CVE-2026-32609 · GCVE-0-2026-32609 NICOLARGO GLANCES UP TO 4.5.1 ENDPOINT /API/V4/CONFIG AS_DICT_SECURE INFORMATION DISCLOSURE HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 6.3 $0-$5k 0.34+ Summaryinfo A vulnerability marked as problematic has been reported in nicolargo glances up to 4.5.1. Affected is the function as_dict_secure of the file /api/v4/config of the component Endpoint. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-32609. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component. Detailsinfo A vulnerability was found in nicolargo glances up to 4.5.1. It has been classified as problematic. This affects the function as_dict_secure of the file /api/v4/config of the component Endpoint. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is: Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-32609 since 03/12/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue. Upgrading to version 4.5.2 eliminates this vulnerability. Productinfo Vendor nicolargo Name glances Version 4.5.0 4.5.1 Website Product: https://github.com/nicolargo/glances/ CPE 2.3info 🔒 🔒 CPE 2.2info 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 6.4 VulDB Meta Temp Score: 6.3 VulDB Base Score: 5.3 VulDB Temp Score: 5.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 7.5 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Information disclosure CWE: CWE-200 / CWE-284 / CWE-266 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: glances 4.5.2 Timelineinfo 03/12/2026 CVE reserved 03/18/2026 +6 days Advisory disclosed 03/18/2026 +0 days VulDB entry created 03/18/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: github.com Status: Confirmed CVE: CVE-2026-32609 (🔒) GCVE (CVE): GCVE-0-2026-32609 GCVE (VulDB): GCVE-100-351537 Entryinfo Created: 03/18/2026 16:19 Changes: 03/18/2026 16:19 (66) Complete: 🔍 Cache ID: 99:DF4:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸