Glances is an open‑source cross‑platform monitoring tool. When the web server is started with the option glances -w, the REST API is enabled but, prior to version 4.5.2, it runs without any authentication. This configuration allows any network client that can reach the service to retrieve sensitive system data, including process command‑lines that may contain credentials such as passwords, API keys or tokens. The vulnerability is a classic Information Exposure (CWE‑200) that can lead to confidentiality loss.

The affected product is nicolargo:glances. All releases prior to 4.5.2 are vulnerable; the CPE entry cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:* indicates that the issue applies to all platform, version, edition and architecture variants.

The CVSS score of 8.7 classifies this as a high severity vulnerability. The EPSS score is less than 1 %, suggesting a low probability of current exploitation in the wild, and it is not listed in the CISA KEV catalog. Because the Web API is reachable over the network, an attacker who can communicate with the Glances web server could export sensitive host information, potentially aiding credential theft or lateral movement. The likely attack vector is network‑based and does not require authentication.