Glances 4.5.6 Vulnerability Fixes: Command Injection and Credential Leak

Vulnerability Overview Glances version 4.5.6 fixes multiple security vulnerabilities, including: 1. Value-Level Bypass Leaks Credentials in URL Values - Through the endpoint, the function failed to properly filter credential information within URL values, resulting in credential leakage. - CVE-2026-68520 2. Command Injection Bypass of action-template sanitizer - The refactoring of the in bypassed the sanitization mechanism of the , leading to a command injection vulnerability. - CVE-2026-68518 3. Incomplete fix of CVE-2026-32608 - Nested bypassed the sanitization mechanism of the , leading to a command injection vulnerability. - CVE-2026-62982 4. REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test - The CORS credential protection for the REST API used exact matching instead of membership testing, resulting in credential leakage. - CVE-2026-68517 Affected Scope Value-Level Bypass Leaks Credentials in URL Values - Affects all users utilizing the endpoint, potentially leading to credential leakage. Command Injection Bypass of action-template sanitizer - Affects all users utilizing the feature, potentially leading to command injection attacks. Incomplete fix of CVE-2026-32608 - Affects all users utilizing the feature, potentially leading to command injection attacks. REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test - Affects all users utilizing the REST API, potentially leading to credential leakage. Remediation Value-Level Bypass Leaks Credentials in URL Values - The function has been fixed to ensure that credential information in URL values is properly filtered. Command Injection Bypass of action-template sanitizer - The sanitization mechanism for has been enhanced to prevent command injection via the refactored in . Incomplete fix of CVE-2026-32608 - The sanitization issue with nested has been resolved, ensuring that all values are correctly filtered. REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test - The CORS credential protection mechanism for the REST API has been modified to use membership testing instead of exact matching, ensuring credential security. POC Code or Exploit Code No specific POC code or exploit code was provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Glances 4.5.6 Vulnerability Fixes: Command Injection and Credential Leak

More from this source