An unauthenticated information disclosure vulnerability in Glances exposes sensitive system credentials and configuration details, posing a significant risk to environment security.

The application fails to properly redact sensitive information within the /api/v4/args and /api/v4/args/{item} endpoints. Unauthenticated attackers can access these endpoints to retrieve command-line arguments that contain password hashes, SNMP community strings, and configuration paths.

The exposure of password hashes and SNMP authentication keys provides attackers with the necessary credentials to gain unauthorized access to the underlying system or connected network infrastructure. Given the CVSS score of 7.5, this high-severity vulnerability could lead to lateral movement, complete system compromise, and the breach of sensitive operational data.

Immediate Action: Update the Glances package to version 4.5.2 or later to apply the necessary redaction of sensitive arguments in the API.

Proactive Monitoring: Review web server and application access logs for any suspicious requests directed at the /api/v4/args endpoints originating from unauthorized or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the /api/v4/ path if immediate patching is not feasible, or ensure the service is only accessible via a secure, authenticated VPN tunnel.

Public Exploit Available: Unknown

This vulnerability represents a critical exposure of authentication material that can be trivial to exploit. Organizations utilizing Glances must prioritize the update to version 4.5.2 immediately to prevent credential harvesting. Failure to remediate this flaw leaves the monitoring infrastructure open to unauthorized access and potential full system takeover.