# CVE-2026-30928: Glances - Information Disclosure

> Live exploitation tracking for CVE-2026-30928 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-30928

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** Nicolargo Glances
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** python, management_panel

## Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

## CrowdSec analysis

[CVE-2026-30928](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-30928) is an information disclosure vulnerability in Glances prior to version 4.5.1, where the /api/4/config REST API endpoint exposes the entire configuration file, including sensitive credentials such as database passwords, API tokens, and SSL key passwords. Attackers exploiting this flaw could remotely access confidential information without authentication, potentially leading to further compromise of backend services and systems.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-30928 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/api/4/config` endpoint to retrieve sensitive configuration data, including credentials, from vulnerable Glances instances. This information disclosure is triggered by unauthenticated GET requests to the exposed REST API.

## Timeline

- 2026-03-10: CVE Published. CVE-2026-30928 is published to NVD.
- 2026-04-01: Rule Released. CrowdSec releases a rule to detect CVE-2026-30928 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6
- https://github.com/nicolargo/glances/commit/306a7136154ba5c1531489c99f8306d84eae37da
- https://github.com/nicolargo/glances/releases/tag/v4.5.1
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30928.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-30928) follows observed exploitation activity for CVE-2026-30928. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.