https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:44:10 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32596 <p><strong>Affected:</strong> nicolargo glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.</p> <p><strong>Affected:</strong> nicolargo glances</p> <p>Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-32596 https://vulnerability.circl.lu/vuln/ghsa-wvxv-4j8q-4wjq <p><strong>Affected:</strong> PyPI: Glances</p> <p>### Summary Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client.</p> <p>### Details Root Cause: Authentication is optional and disabled by default. When no password is provided, the API router initializes without authentication dependency, and the server binds to 0.0.0.0 exposing all endpoints.</p> <p>Affected Code: - File: `glances/outputs/glances_restful_api.py`, lines 259-272</p> <p>```python if self.args.password: self._password = GlancesPassword(username=args.username, config=config) if JWT_AVAILABLE: jwt_secret = config.get_value(&#39;outputs&#39;, &#39;jwt_secret_key&#39;, default=None) jwt_expire = config.get_int_value(&#39;outputs&#39;, &#39;jwt_expire_minutes&#39;, default=60) self._jwt_handler = JWTHandler(secret_key=jwt_secret, expire_minutes=jwt_expire) logger.info(f&#34;JWT authentication enabled (token expiration: {jwt_expire} minutes)&#34;) else: self._jwt_handler = None logger.info(&#34;JWT authentication not available (python-jose not installed)&#34;) else: self._password = None # NO AUTHENTICATION BY DEFAULT self._jwt_handler = None ```</p> <p>- File: `glances/outputs/glances_restful_api.py`, lines 477-480</p> <p>```python if self.args.password: router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)]) else: router = APIRouter(prefix=…</p> <p><strong>Affected:</strong> PyPI: Glances</p> <p>### Summary Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client.</p> <p>### Details Root Cause: Authentication is optional and disabled by default. When no password is provided, the API router initializes without authentication dependency, and the server binds to 0.0.0.0 exposing all endpoints.</p> <p>Affected Code: - File: `glances/outputs/glances_restful_api.py`, lines 259-272</p> <p>```python if self.args.password: self._password = GlancesPassword(username=args.username, config=config) if JWT_AVAILABLE: jwt_secret = config.get_value(&#39;outputs&#39;, &#39;jwt_secret_key&#39;, default=None) jwt_expire = config.get_int_value(&#39;outputs&#39;, &#39;jwt_expire_minutes&#39;, default=60) self._jwt_handler = JWTHandler(secret_key=jwt_secret, expire_minutes=jwt_expire) logger.info(f&#34;JWT authentication enabled (token expiration: {jwt_expire} minutes)&#34;) else: self._jwt_handler = None logger.info(&#34;JWT authentication not available (python-jose not installed)&#34;) else: self._password = None # NO AUTHENTICATION BY DEFAULT self._jwt_handler = None ```</p> <p>- File: `glances/outputs/glances_restful_api.py`, lines 477-480</p> <p>```python if self.args.password: router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)]) else: router = APIRouter(prefix=…</p> https://vulnerability.circl.lu/vuln/ghsa-wvxv-4j8q-4wjq