github.com/nicolargo/glances
Submitted 8/4/2026, 10:28:01 AM · Status: ok
Risk grade
F
100 / 100
Findings
52
0 critical9 high40 medium3 low0 info0 on CISA KEV0ATT&CK
Showing 52 of 52 findings
Findings
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksgrypeCVE-2026-52870EPSS 0.2%
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalgrypeCVE-2026-52869EPSS 0.3%
- MCP Python SDK: WebSocket server transport does not support Host/Origin validationgrypeCVE-2026-59950EPSS 0.1%
- Minerva timing attack on P-256 in python-ecdsagrypeCVE-2024-23342EPSS 1.0%
- subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list ansubprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)semgrepglances/amps/systemd/__init__.py:62
- subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list ansubprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)semgrepglances/globals.py:166
- Image user should not be 'root'Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.trivydocker-files/alpine.Dockerfile:0
- Image user should not be 'root'Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.trivydocker-files/ubuntu.Dockerfile:0
- Ensure that a user for the container has been createdEnsure that a user for the container has been created on /docker-files/ubuntu.Dockerfile.checkovdocker-files/ubuntu.Dockerfile:1
- Ensure that a user for the container has been createdEnsure that a user for the container has been created on /docker-files/alpine.Dockerfile.checkovdocker-files/alpine.Dockerfile:1
- Ensure that arrays have a maximum number of itemsEnsure that arrays have a maximum number of items on pathscheckovdocs/api/openapi.json:0
- Ensure that HEALTHCHECK instructions have been added to container imagesEnsure that HEALTHCHECK instructions have been added to container images on /docker-files/ubuntu.Dockerfile.checkovdocker-files/ubuntu.Dockerfile:1
- Ensure that HEALTHCHECK instructions have been added to container imagesEnsure that HEALTHCHECK instructions have been added to container images on /docker-files/alpine.Dockerfile.checkovdocker-files/alpine.Dockerfile:1
- Ensure that security operations is not empty.Ensure that security operations is not empty. on securitycheckovdocs/api/openapi.json:0
- Ensure that the global security field has rules definedEnsure that the global security field has rules defined on securitycheckovdocs/api/openapi.json:0
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(cyber)checkov.github/workflows/cyber.yml:14
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(build_docker)checkov.github/workflows/build_docker.yml:30
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(quality)checkov.github/workflows/quality.yml:11
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(webui)checkov.github/workflows/webui.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(test)checkov.github/workflows/test.yml:14
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could obse…osv-scannerCVE-2026-52870
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could obse…osv-scannerCVE-2026-52870
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could obse…osv-scannerCVE-2026-52870
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could obse…osv-scannerCVE-2026-52870
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could obse…osv-scannerCVE-2026-52870
- MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could obse…osv-scannerCVE-2026-52870
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who le…osv-scannerCVE-2026-52869
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who le…osv-scannerCVE-2026-52869
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who le…osv-scannerCVE-2026-52869
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who le…osv-scannerCVE-2026-52869
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who le…osv-scannerCVE-2026-52869
- MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who le…osv-scannerCVE-2026-52869
- MCP Python SDK: WebSocket server transport does not support Host/Origin validation### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable …osv-scannerCVE-2026-59950
- MCP Python SDK: WebSocket server transport does not support Host/Origin validation### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable …osv-scannerCVE-2026-59950
- MCP Python SDK: WebSocket server transport does not support Host/Origin validation### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable …osv-scannerCVE-2026-59950
- MCP Python SDK: WebSocket server transport does not support Host/Origin validation### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable …osv-scannerCVE-2026-59950
- MCP Python SDK: WebSocket server transport does not support Host/Origin validation### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable …osv-scannerCVE-2026-59950
- MCP Python SDK: WebSocket server transport does not support Host/Origin validation### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable …osv-scannerCVE-2026-59950
- Minerva timing attack on P-256 in python-ecdsapython-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key gen…osv-scannerCVE-2024-23342
- Minerva timing attack on P-256 in python-ecdsapython-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key gen…osv-scannerCVE-2024-23342
- Minerva timing attack on P-256 in python-ecdsapython-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key gen…osv-scannerCVE-2024-23342
- Minerva timing attack on P-256 in python-ecdsapython-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key gen…osv-scannerCVE-2024-23342
- uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided### Summary The `v3()`, `v5()`, and `v6()` [API methods](https://github.com/uuidjs/uuid#api-summary) (not `uuid` release versions) accept external output buffers but do not reject out-of-range writes (small `buf` or large `offset`). By contrast, `v4()`, `v1()`, and `v7()` API …osv-scannerCVE-2026-41907
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepglances/password.py:88
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepglances/outputs/glances_stdout_api_restful_doc.py:131
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepglances/main.py:822
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepglances/main.py:816
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepdocs/api/restful.rst:111
This report is public.