CVE-2026-68520

## Summary Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by '********'". However, the implementation only checks KEY names against a regex pattern and never inspects VALUE content. The documented `[ip]` config section supports `public_api` (URL), `public_username` (login), and `public_password` (password). While `public_password` is correctly masked, both `public_api` (when containing embedded credentials like `https://user:pass@host/`) and `public_username` are returned in full to unauthenticated users via `GET /api/4/config`. ## Affected Versions Glances latest (Docker: `nicolargo/glances:latest`) ## Root Cause In `glances/config.py`, `as_dict_secure()`: ```python _SECURE_SENSITIVE_KEY_RE = re.compile(r"password|token|secret|api_key|apikey|ssl_keyfile", re.IGNORECASE) def as_dict_secure(self): """Return a sanitised copy of the configuration dict. Intended for unauthenticated API access. - Sensitive keys in remaining sections are replaced by '********'. """ sanitized = {} for section, options in self.as_dict().items(): if section in _SECURE_BLOCKED_SECTIONS: continue sanitized[section] = { key: "********" if _SECURE_SENSITIVE_KEY_RE.search(key) else value for key, value in options.items() } return sanitized ``` In `glances/outputs/glances_restful_api.py`: ```python # Line 1294 args_json = self.config.as_dict() if self.args.password else self.config.as_dict_secure() ``` The `[ip]` config section documents: `public_api` (URL), `public_username` (login), `public_password` (password). - `public_password` → matches "password" → masked ✓ - `public_api` → no match → returned in full (contains `user:pass@` in URL) ✗ - `public_username` → no match → returned in full ✗ ## Impact - Unauthenticated credential disclo