THREAT OPS › Threat News › [GHSA] GHSA-4h34-v6r8-mmjc (medium) — Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
[GHSA] GHSA-4h34-v6r8-mmjc (medium) — Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
GHSA-4h34-v6r8-mmjc Severity: medium CVE: CVE-2026-68520
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
## Summary
Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by '****
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-68520cve
- https://user:pass@host/`url
- http://10.140.200.102:8080`url
- https://ipv4.ipleak.net/json/|public_api=https://admin:secret123@ipv4.ipleak.net/json/|url
- secret123@ipv4.ipleak.netemail
Original source: https://github.com/advisories/GHSA-4h34-v6r8-mmjc