CVE-2026-68519 in Glances
Summary
by MITRE • 08/17/2026
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secure_popen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
Glances is a widely deployed open-source system monitoring tool designed for cross-platform compatibility, providing real-time insights into CPU, memory, disk, and network usage across various operating systems. The software allows administrators to configure alerting mechanisms that trigger specific actions when certain thresholds are exceeded. A critical security flaw was identified in the command execution logic prior version 4.5.6, specifically within the GlancesActions.run() method located in the glances/actions.py module. This vulnerability stems from an improper handling of configuration flags related to action execution safety.
The core technical flaw involves the disregard for the --disable-config-exec flag when processing on-alert actions. When this flag is intended to disable arbitrary command execution via configuration files, it was effectively bypassed during alert triggers. Consequently, the application invoked secure_popen() with shell operators enabled rather than in a safe mode that restricts interpretation of special characters. This oversight allows an attacker who can influence or control the alert conditions and associated action configurations to inject malicious payloads into the command string.
Because shell operators such as redirection symbols, semicolons for command chaining, and pipes are interpreted by the underlying system shell rather than being treated as literal arguments, this vulnerability enables arbitrary code execution. An adversary could exploit this by crafting a scenario where an alert condition is met or manipulated to trigger a configured action containing malicious syntax. For instance, using pipe characters allows the injection of additional commands that execute with the privileges of the user running the Glances process. This represents a classic command injection weakness, categorized under CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection).
The operational impact of this vulnerability is severe, particularly in environments where Glances runs with elevated permissions or monitors critical infrastructure components. Successful exploitation allows for remote code execution if the monitoring service is accessible over a network and configuration files are writable by untrusted users. Even without direct write access to config files, an attacker might exploit other vulnerabilities to manipulate alert states or leverage social engineering to trick administrators into enabling dangerous configurations. The ability to chain commands means that initial injection points can lead to full system compromise, data exfiltration, or lateral movement within the network depending on the context of the Glances deployment.
Mitigation strategies primarily involve upgrading to version 4.5.6 or later, where this logic error has been corrected to respect the --disable-config-exec flag and ensure shell operators are not interpreted during alert actions. For systems that cannot be immediately updated, administrators should audit configuration files for any on-alert action commands that rely on shell features such as pipes, redirections, or command separators. It is also recommended to enforce strict file permissions on Glances configuration directories to prevent unauthorized modifications. Additionally, running the monitoring service with minimal required privileges reduces the potential blast radius of a successful exploitation attempt. Adhering to these practices aligns with security best practices outlined in MITRE ATT&CK techniques related to command and script interpretation, specifically T1059: Command and Scripting Interpreter.