LoginSign Up
← Back to all sparks
G

Glances

ANALYTICS
Velocity2.5

Cross-platform system monitoring tool with web and terminal interfaces

nicolargo.github.io/glances ↗

Every Glances release this year has carried CVE fixes — the monitoring tool is being audited in public.

system monitoringsecurity auditgpu monitoringrest apicontainers
◆Current state
Six releases since March, and all but one ship security patches. 4.5.2 alone corrected eight CVEs: CORS defaults allowing cross-origin credential theft, incomplete secrets redaction leaking password hashes and SNMP credentials through /api/v4/args, missing host validation leaving the REST API open to DNS rebinding, SQL injection in the DuckDB export, command injection through process names in action templates, and credential leakage via Zeroconf-spoofed browser autodiscovery. The pattern continues through 4.5.3, 4.5.4, 4.5.5 and 4.5.6, the last fixing a value-level bypass that leaked credentials embedded in URL config values. Alongside it, hardware coverage keeps widening — Intel and AMD GPUs, NVIDIA Jetson, Rockchip NPU and MPP, Raspberry Pi VideoCore.
◆Where it's heading
This is what it looks like when a tool that grew up as a local terminal dashboard gets taken seriously as a network service. Nearly every advisory in the window comes from the same root assumption — that the REST API, XML-RPC server and autodiscovery browser are on a trusted network — and the fixes are systematically removing that assumption: authentication warnings on startup, host validation, tighter CORS, redaction that covers values as well as keys. The feature work continues in parallel and is almost entirely about reading more kinds of hardware.
◆Prediction
The advisories have moved from transport-level exposure toward data-level leaks in specific endpoints, which suggests the remaining audit surface is the export backends and config serialisation rather than the servers themselves. Expect the next release to follow the same shape: hardware plugin additions plus another round of endpoint fixes.

◆Recent moves

  1. 6d ago

    Credential leak via URL values in /api/4/config

    Fixes a credential leak where as_dict_secure() redacted keys but not values, exposing credentials embedded in URLs through /api/4/config, plus GPU plugin duplication in multi-GPU systems and a misleading VideoCore memory denominator on Raspberry Pi 5.

    View source ↗
  2. 1mo ago

    Container API latency, ARM GPU monitoring, and an AMP command-execution fix

    Cuts container API latency that left /api/4/containers taking four to five seconds with around sixty Docker containers, adds ARM and Raspberry Pi GPU monitoring plus NVIDIA Jetson process and temperature reporting, and fixes arbitrary file write and command execution in AMP command configuration.

    View source ↗
  3. 3mo ago

    Rockchip MPP and NPU monitoring, plus three CVE corrections

    Adds a Rockchip MPP plugin for hardware encoder and decoder monitoring and single-core NPU load parsing, and corrects three CVEs — SSRF in the IP plugin leaking credentials, unauthenticated cross-origin disclosure via /api/4, and CQL injection in the Cassandra export.

    View source ↗
  4. 4mo ago

    LXC/LXD support, ClickHouse export, and two CVE mitigations

    LXC and LXD container support and a ClickHouse export arrive, alongside mitigations for command injection through dynamic configuration values and cross-origin disclosure via an XML-RPC CORS wildcard.

    View source ↗
  5. 4mo ago

    Eight CVEs corrected in one release

    Eight CVEs corrected in one release, covering CORS credential theft, incomplete secrets redaction, DNS rebinding, unauthenticated API exposure, SQL injection in the DuckDB export, command injection via process names, and reusable credentials leaked through browser autodiscovery. The single largest security pass in this window.

    View source ↗
  6. 5mo ago

    Stability fixes, Intel GPU monitoring, and container health alerting

    A stability release cleaning up regressions from the 4.5.0.x series and OpenBSD, macOS and Snap compatibility, with Intel GPU monitoring, Docker container health alerting and per-plugin min/max/mean statistics added.

    View source ↗