Nixpkgs security tracker
NIXPKGS-2026-0583
GitHub issue
published on
by @mweinelt Activity log
- Created suggestion
-
@mweinelt
ignored
5 packages
- python312Packages.glances-api
- python313Packages.glances-api
- python314Packages.glances-api
- home-assistant-component-tests.glances
- tests.home-assistant-component-tests.glances
- @mweinelt accepted
- @mweinelt published on GitHub
Glances Exposes Unauthenticated Configuration Secrets
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.
References
-
https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6 x_refsource_CONFIRM
-
https://github.com/nicolargo/glances/releases/tag/v4.5.1 x_refsource_MISC
Affected products
glances
- ==< 4.5.1
Matching in nixpkgs
Ignored packages (5)
pkgs.python312Packages.glances-api
Python API for interacting with Glances
pkgs.python313Packages.glances-api
Python API for interacting with Glances
pkgs.python314Packages.glances-api
Python API for interacting with Glances
pkgs.home-assistant-component-tests.glances
Open source home automation that puts local control and privacy first
pkgs.tests.home-assistant-component-tests.glances
Open source home automation that puts local control and privacy first
Package maintainers
-
@primeos Michael Weiss <dev.primeos@gmail.com>
-
@k0ral Koral <koral@mailoo.org>