CVE-2026-68520: Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Glances provides as_dict_secure() explicitly designed for unauthenticated API access, with a docstring stating it returns “a sanitised copy of the configuration dict” where “Sensitive keys in remaining sections are replaced by ‘********’”. However, the implementation only checks KEY names against a regex pattern and never inspects VALUE content. The documented [ip] config section supports public_api (URL), public_username (login), and public_password (password). While public_password is correctly masked, both public_api (when containing embedded credentials like https://user:pass@host/) and public_username are returned in full to unauthenticated users via GET /api/4/config.