NIXPKGS-2026-0583
GitHub issue
published on 11 Mar 2026
by @mweinelt Activity log
- Created automatic suggestion
-
@mweinelt
removed
5 packages
- python312Packages.glances-api
- python313Packages.glances-api
- python314Packages.glances-api
- home-assistant-component-tests.glances
- tests.home-assistant-component-tests.glances
- @mweinelt accepted
- @mweinelt published on GitHub
Glances Exposes Unauthenticated Configuration Secrets
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
References
-
https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6 x_refsource_CONFIRM
-
https://github.com/nicolargo/glances/releases/tag/v4.5.1 x_refsource_MISC
Affected products
glances
- ==< 4.5.1
Matching in nixpkgs
Ignored packages (5)
pkgs.python312Packages.glances-api
Python API for interacting with Glances
pkgs.python313Packages.glances-api
Python API for interacting with Glances
pkgs.python314Packages.glances-api
Python API for interacting with Glances
pkgs.home-assistant-component-tests.glances
Open source home automation that puts local control and privacy first
pkgs.tests.home-assistant-component-tests.glances
Open source home automation that puts local control and privacy first
Package maintainers
-
@primeos Michael Weiss <dev.primeos@gmail.com>
-
@k0ral Koral <koral@mailoo.org>