Glances is a cross‑platform monitoring tool whose API endpoints expose internal configuration information. The /api/v4/args and /api/v4/args/{item} endpoints return a full command‑line argument namespace via vars(self.args). This namespace contains sensitive secrets such as password hashes (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the path to the configuration file. The vulnerability is a direct information disclosure (CWE‑200) that allows an attacker to obtain confidential credential material without authentication.

The issue affects all Glances releases prior to v4.5.2. The affected vendor product is nicolargo:glances and the affected versions are those lacking the patch that introduces the as_dict_secure redaction for all API endpoints. The vendor released a more complete fix in Glances 4.5.2, which removes the exposed credential data from the API responses.

The CVSS score of 7.5 indicates a moderate‑to‑high severity impact. The EPSS score is below 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KeV catalog. Attackers can exploit the flaw by sending unauthenticated requests to the /api/v4/args endpoints and capturing the returned JSON payload, thereby retrieving the secrets. The lack of authentication on default installations creates a straightforward attack pathway.