SB2026080334 - Multiple vulnerabilities in glances

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080334

SB2026080334 - Multiple vulnerabilities in glances

Published: August 3, 2026

Security Bulletin ID SB2026080334
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2026-68519)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands and write arbitrary files.

The vulnerability exists due to improper neutralization of special elements in the on-alert action command path when processing configuration-defined alert actions. A remote user can place shell operators in an alert action command in the configuration file to execute arbitrary commands and write arbitrary files.

The issue occurs even when the --disable-config-exec flag is enabled, and exploitation requires the configured alert to trigger.


2) OS Command Injection (CVE-ID: CVE-2026-68518)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary commands.

The vulnerability exists due to improper neutralization of special elements used in an OS command in the Glances action template rendering and execution pipeline when concatenating two adjacent unescaped Mustache variables in an administrator-configured action template. A local user can control neighboring stat fields so that shell operators are reconstructed across field boundaries to execute arbitrary commands.

Exploitation requires an administrator-configured action template that uses adjacent unescaped Mustache variables without a separator.


3) OS Command Injection (CVE-ID: CVE-2026-62982)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary commands.

The vulnerability exists due to improper neutralization of special elements in action command templates when rendering nested process stat values such as cmdline. A local user can supply a specially crafted process command line to execute arbitrary commands.

Exploitation requires a configured alert action template that renders a nested stat field, such as the process cmdline, and Glances must be able to enumerate the attacker's process.


4) Overly permissive cross-domain whitelist (CVE-ID: CVE-2026-68517)

CWE-ID: CWE-942 - Overly Permissive Cross-domain Whitelist

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to permissive cross-domain security policy enforcement in the REST API CORS credentials guard when processing a multi-origin allowlist that includes the wildcard. A remote attacker can host a malicious website to disclose sensitive information.

User interaction is required, and the victim must have previously authenticated to the Glances instance through their browser.


Remediation

Install update from vendor's website.

References