The vulnerability allows an unauthenticated attacker who can reach the Glances Browser API endpoint `/api/4/serverslist` to retrieve raw server objects that contain a `uri` field embedding HTTP Basic credentials for downstream Glances servers. These credentials are generated from a reusable pbkdf2-derived secret and are stored in memory via `GlancesServersList.get_servers_list()`. Exposing these credentials compromises the confidentiality and integrity of the downstream servers, potentially allowing an attacker to gain unauthorized access and control. The issue is a classic Information Exposure (CWE-200) and Sensitive Data Storage (CWE-522) scenario.

All versions of the open‑source monitoring tool Glances from the vendor nicolargo, prior to the release of version 4.5.2, are affected. The problem appears only in Central Browser mode and when the Browser/API instance is started without the --password flag, which is frequently used in internal network deployments.

The flaw has a CVSS score of 9.1, indicating high severity, but an EPSS score of less than 1%, implying a low current probability of exploitation. It is not listed in CISA’s KEV catalog. The attack vector is network-based: any host that can reach the unauthenticated Browser API can pull the downstream credentials. Once obtained, the attacker can authenticate to downstream Glances servers, potentially taking full control of those systems. The lack of authentication on the endpoint combined with the exposure of reusable credentials makes exploitation straightforward for privileged network users.