CVE-2026-32609: Glances /api/v4/args Endpoint Leaks Password Hash Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cvwp-r2g2-j824",
  "modified" : "2026-03-19T21:06:22Z",
  "published" : "2026-03-16T16:26:54Z",
  "aliases" : [ "CVE-2026-32609" ],
  "summary" : "Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials",
  "details" : "## Summary\n\nThe GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication.\n\n## Details\n\nThe secrets exposure fix (GHSA-gh4x, commit 5d3de60) modified three config-related endpoints to use `as_dict_secure()` when no password is configured:\n\n```python\n# glances/outputs/glances_restful_api.py:1168 (FIXED)\nargs_json = self.config.as_dict() if self.args.password else self.config.as_dict_secure()\n```\n\nHowever, the `_api_args` and `_api_args_item` endpoints were not part of this fix and still return all arguments without any sanitization:\n\n```python\n# glances/outputs/glances_restful_api.py:1222-1237\ndef _api_args(self):\n    try:\n        # Get the RAW value of the args dict\n        # Use vars to convert namespace to dict\n        args_json = vars(self.args)\n    except Exception as e:\n        raise HTTPException(status.HTTP_404_NOT_FOUND, f\"Cannot get args ({str(e)})\")\n\n    return GlancesJSONResponse(args_json)\n```\n\nAnd the item-specific endpoint:\n\n```python\n# glances/outputs/glances_restful_api.py:1239-1258\ndef _api_args_item(self, item: str):\n    ...\n    args_json = vars(self.args)[item]\n    return GlancesJSONResponse(args_json)\n```\n\nThe `self.args` namespace contains sensitive fields set during initialization in `glances/main.py`:\n\n1. **`password`** (line 806-819): When `--password` is used, this contains the salt + pbkdf2_hmac hash. An attacker can use this for offline brute-force attacks.\n\n2. **`snmp_community`** (line 445): Default `\"public\"`, but may be set to a secret community string for SNMP monitoring.\n\n3. **`snmp_user`** (line 448): SNMP v3 username, default `\"private\"`.\n\n4. **`snmp_auth`** (line 450): SNMP v3 authentication key, default `\"password\"` but typically set to a secret value.\n\n5. **`conf_file`** (line 198): Path to the configuration file, reveals filesystem structure.\n\n6. **`username`** (line 430/800): The Glances authentication username.\n\nBoth endpoints are registered on the authenticated router (line 504-505):\n```python\nf'{base_path}/args': self._api_args,\nf'{base_path}/args/{{item}}': self._api_args_item,\n```\n\nWhen `--password` is not set (the default), the router has NO authentication dependency (line 479-480), making these endpoints completely unauthenticated:\n```python\nif self.args.password:\n    router = APIRouter(prefix=self.url_prefix, dependencies=[Depends(self.authentication)])\nelse:\n    router = APIRouter(prefix=self.url_prefix)\n```\n\n## PoC\n\n**Scenario 1: No password configured (default deployment)**\n\n```bash\n# Start Glances in web server mode (default, no password)\nglances -w\n\n# Access all command line arguments without authentication\ncurl -s http://localhost:61208/api/4/args | python -m json.tool\n\n# Expected output includes sensitive fields:\n# \"password\": \"\",\n# \"snmp_community\": \"public\",\n# \"snmp_user\": \"private\",\n# \"snmp_auth\": \"password\",\n# \"username\": \"glances\",\n# \"conf_file\": \"/home/user/.config/glances/glances.conf\",\n\n# Access specific sensitive argument\ncurl -s http://localhost:61208/api/4/args/snmp_community\ncurl -s http://localhost:61208/api/4/args/snmp_auth\n```\n\n**Scenario 2: Password configured (authenticated deployment)**\n\n```bash\n# Start Glances with password authentication\nglances -w --password --username admin\n\n# Authenticate and access args (password hash exposed to authenticated users)\ncurl -s -u admin:mypassword http://localhost:61208/api/4/args/password\n# Returns the salt$pbkdf2_hmac hash which enables offline brute-force\n```\n\n## Impact\n\n- **Unauthenticated network reconnaissance:** When Glances runs without `--password` (the common default for internal/trusted networks), anyone who can reach the web server can enumerate SNMP credentials, usernames, file paths, and all runtime configuration.\n\n- **Offline password cracking:** When authentication is enabled, an authenticated user can retrieve the password hash (salt + pbkdf2_hmac) and perform offline brute-force attacks. The hash uses pbkdf2_hmac with SHA-256 and 100,000 iterations (see `glances/password.py:45`), which provides some protection but is still crackable with modern hardware.\n\n- **Lateral movement:** Exposed SNMP community strings and v3 authentication keys can be used to access other network devices monitored by the Glances instance.\n\n- **Supply chain for CORS attack:** Combined with the default CORS misconfiguration (finding 001), these secrets can be stolen cross-origin by a malicious website.\n\n## Recommended Fix\n\nApply the same redaction pattern used for the `/api/v4/config` endpoints:\n\n```python\n# glances/outputs/glances_restful_api.py\n\n_SENSITIVE_ARGS = frozenset({\n    'password', 'snmp_community', 'snmp_user', 'snmp_auth',\n    'conf_file', 'password_prompt', 'username_used',\n})\n\ndef _api_args(self):\n    try:\n        args_json = vars(self.args).copy()\n        if not self.args.password:\n            for key in _SENSITIVE_ARGS:\n                if key in args_json:\n                    args_json[key] = \"********\"\n        # Never expose the password hash, even to authenticated users\n        if 'password' in args_json and args_json['password']:\n            args_json['password'] = \"********\"\n    except Exception as e:\n        raise HTTPException(status.HTTP_404_NOT_FOUND, f\"Cannot get args ({str(e)})\")\n    return GlancesJSONResponse(args_json)\n\ndef _api_args_item(self, item: str):\n    if item not in self.args:\n        raise HTTPException(status.HTTP_400_BAD_REQUEST, f\"Unknown argument item {item}\")\n    try:\n        if item in _SENSITIVE_ARGS:\n            if not self.args.password:\n                return GlancesJSONResponse(\"********\")\n            if item == 'password':\n                return GlancesJSONResponse(\"********\")\n        args_json = vars(self.args)[item]\n    except Exception as e:\n        raise HTTPException(status.HTTP_404_NOT_FOUND, f\"Cannot get args item ({str(e)})\")\n    return GlancesJSONResponse(args_json)\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "Glances"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/security/advisories/GHSA-cvwp-r2g2-j824"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-32609"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/commit/ff14eb9780ee10ec018c754754b1c8c7bfb6c44f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nicolargo/glances"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nicolargo/glances/releases/tag/v4.5.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-16T16:26:54Z",
    "nvd_published_at" : "2026-03-18T15:16:30Z"
  }
}