Incomplete Fix for Glances Configuration Command Execution Bypass

Glances version 4.5.5 and earlier versions contain a vulnerability identified as CVE-2026-68519, which acts as an incomplete fix for a previously reported issue (CVE-2026-53925). While the --disable-config-exec flag successfully restricts shell operator interpretation in Application Monitoring Plugin (AMP) modules, the restriction is not applied to the 'on-alert action' command path.

Defenders should note that Glances reads command lines from the glances.conf file. If an attacker gains write access to this configuration file, they can inject shell operators such as && (chaining), | (pipe), or > (file redirection) into alert action fields. Because the glances/actions.py module fails to pass the allow_operators constraint to the secure_popen() function in the alert action code path, these injected commands are executed with the privileges of the Glances process. This vulnerability effectively negates the security guarantees provided by the --disable-config-exec flag.

Impact

Successful exploitation allows an attacker with access to modify the Glances configuration file to achieve arbitrary command execution or unauthorized file writes. This represents a significant escalation of privilege or persistence mechanism, as the commands execute under the security context of the Glances daemon or user process.

Recommendation

• Upgrade Glances to the version addressing CVE-2026-68519 as soon as it becomes available.
• Audit the integrity of the glances.conf file across all monitored environments to ensure no unauthorized alert actions have been injected.
• Restrict write access to the glances.conf file to a minimal set of highly privileged administrative users.
• Monitor for unexpected process creation events spawned by the glances process, specifically processes launched as children of the main Glances application.