Glances is an open-source cross-platform system monitoring tool. Versions prior to 4.5.6 contain a vulnerability in the as_dict_secure() function located in glances/config.py. This function inadequately checks option names, resulting in exposure of sensitive information such as public_username and credentials embedded in public_api values. These details can be accessed through unauthenticated GET requests to the /api/4/config and /api/4/config/ip endpoints. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS v3.1 base score of 5.3, indicating medium severity. The issue is resolved in version 4.5.6.

An unauthenticated attacker can retrieve sensitive information including usernames and credentials from the affected Glances API endpoints. This exposure could potentially lead to further unauthorized access or information disclosure. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Upgrade Glances to version 4.5.6 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version upgrade to ensure remediation. Until upgraded, restrict access to the affected API endpoints to trusted users or networks if possible.