Glances exposes host telemetry when its web server starts without authentication
Glances is a cross-platform system monitor. Its web mode presents CPU, memory, disk, process, network, and container information through a browser and a REST API. That information is useful to an operator and equally useful to someone mapping a host. The official REST API documentation states that the web server runs without authentication by default and binds to all network interfaces unless configured otherwise.
The service can use HTTP Basic authentication and JWT bearer tokens when the operator enables them. The existence of those options does not change the default review. A deployment that starts Glances for convenience and later exposes it through a reverse proxy may inherit a public telemetry endpoint with no login.
What the count says
On 2026-11-08, count-only probes used sub_type=all, page 1, and page size 1. app="Glances" returned 0, title="Glances" returned 684, and port="61208" && title="Glances" returned 0.
The title count is the only positive signal in this set. It may include dashboards that render Glances data without running the product on that host. The absence of an app signature and a default-port title match means the count is not a complete inventory. A server can use a different title, a non-default port, or a reverse proxy that rewrites the page.
Why host telemetry is sensitive
Process names can reveal installed software and operational roles. Disk and network metrics can identify database, backup, and VPN hosts. Container information can disclose image names and deployment patterns. The API may expose endpoints that an operator did not intend to make public even when the human-facing dashboard looks harmless.
The API documentation also matters for authentication testing. A login page at one route does not prove that /api is protected. A reverse proxy rule that protects / but forwards /api/ directly can leave the data path open. Test both the HTML application and the API endpoints.
Review checklist
Bind Glances to a management interface rather than 0.0.0.0 where possible. Put authentication in front of both the web UI and API. Use a reverse proxy that removes any untrusted forwarding headers and restricts access by network identity or an authenticated session. Set a strong credential or token policy and rotate it after exposure.
Review the enabled plugins. A monitoring endpoint may expose sensors, containers, Docker socket information, or network interfaces beyond the minimum needed by the dashboard. Limit plugin permissions and do not run the service with more host access than the selected checks require. Check rate limits and request size limits as well as authentication.
Defensive baseline
Glances belongs on a monitoring network with explicit authentication. Inventory by title, default port, and API behavior. Use ZoomEye to find candidate hosts, but confirm ownership and the actual /api policy before drawing any conclusion about a deployment.
Top comments (0)