An unauthenticated information exposure vulnerability in Glances versions prior to 4.5.2 allows remote attackers to access sensitive system data and credentials.

This vulnerability involves an improper configuration where the Glances web server runs without authentication by default when started with the -w flag. This exposes the REST API to any network client, allowing unauthorized access to sensitive information, such as process command-lines that may contain passwords, API keys, or tokens.

Successful exploitation of this vulnerability poses a severe risk to organizational security. Because the exposure includes cleartext credentials and API tokens, attackers can leverage this information to escalate privileges, gain unauthorized access to connected cloud services, or move laterally within the internal network. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent the compromise of administrative secrets and sensitive environment variables.

Immediate Action: Update the Glances package to version 4.5.2 or later to enforce mandatory authentication for the web server interface.

Proactive Monitoring: Review access logs for the Glances REST API for unexpected connections from external or unauthorized IP addresses.

Compensating Controls: If an immediate update is not feasible, restrict network access to the Glances web interface using firewall rules or a reverse proxy requiring mutual TLS or VPN-based authentication.

Public Exploit Available: No (Exploit maturity is limited to a Nuclei detection template).

The risk of credential theft resulting from this vulnerability is significant, as it provides attackers with the keys to further infrastructure compromise. Administrators must prioritize updating to version 4.5.2 immediately. In environments where Glances is exposed to the network, ensure that strict access control lists are in place until the patch is deployed and verified.