Glances, a system monitoring tool, has a function as_dict_secure() that validates only option names. Prior to version 4.5.6, the function inadvertently exposed public_username and credentials stored in public_api values when users accessed /api/4/config or /api/4/config/ip without authentication. The result is that attackers can obtain stored credentials embedded in URL values, leading to credential disclosure. The weakness is defined as CWE‑200.

The vulnerability affects the glances package from the nicolargo vendor. All installations using glances versions earlier than 4.5.6 are impacted. Versions 4.5.6 and later include a fix that removed the exposure of credentials via the REST API.

The CVSS score of 5.3 indicates moderate severity. Since the exploit requires unauthenticated access to publicly exposed API endpoints, an attacker who can reach the host can retrieve credentials. EPSS data is unavailable, so the current probability of exploitation is unknown; however, the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote over HTTP/HTTPS, with minimal prerequisites beyond network connectivity to the Glances API. If disabled externally, the risk is mitigated.