CVE-2026-35588

Published: Apr 21, 2026Modified: Jun 17, 2026

6.3

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Exploitability: 0.8 / Impact: 5.5

Source: security-advisories@github.com (Secondary)

Description

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.

Affected (1)

Products: Nicolargo: Glances

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nicolargo Glances	Before 4.5.4

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (4)

https://github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160

Source: security-advisories@github.com

Patch

https://github.com/nicolargo/glances/commit/e41b665576f9fd5374e3152078726cc59a01e48c

Source: security-advisories@github.com

Patch

https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.