Glances versions prior to 4.5.1 expose the entire parsed configuration file through the /api/4/config REST endpoint without any filtering of sensitive values. The configuration contains database passwords, API tokens, JWT signing keys, and SSL key passwords. An attacker that can reach the endpoint can retrieve these credentials, enabling subsequent attacks such as unauthorized database access, token misuse, or privilege escalation, thereby compromising confidentiality and potentially integrity of the protected systems.

The vulnerability affects the nicolargo Glances monitoring tool in all releases before 4.5.1. This includes version 4.5.0 and any earlier stable builds. The affected product is the Glances system cross‑platform monitoring application.

An unauthenticated attacker with network access to a Glances instance can call the /api/4/config endpoint and obtain the full configuration file, including database passwords, API tokens, JWT signing keys, and SSL key passwords. This allows the attacker to compromise backend services, gain unauthorized database access, hijack JWT tokens or use SSL key material to decrypt traffic. The CVSS score of 8.7 reflects this high impact; the EPSS score of 8% indicates a moderate probability of exploitation in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. The lack of authentication on the endpoint makes the attack straightforward, and the exposure of sensitive credentials can lead to serious confidentiality breaches of both the monitoring tool and the services it observes.