{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/glances-4.5.2-to-4.5.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-68519"},{"cvss":7.8,"id":"CVE-2026-53925"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Glances (\u003c= 4.5.5)","Glances (4.5.2 to 4.5.5)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","security-bypass","command-injection","local-privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Glances"],"content_html":"\u003cp\u003eGlances version 4.5.5 and earlier versions contain a vulnerability identified as CVE-2026-68519, which acts as an incomplete fix for a previously reported issue (CVE-2026-53925). While the \u003ccode\u003e--disable-config-exec\u003c/code\u003e flag successfully restricts shell operator interpretation in Application Monitoring Plugin (AMP) modules, the restriction is not applied to the 'on-alert action' command path.\u003c/p\u003e\n\u003cp\u003eDefenders should note that Glances reads command lines from the \u003ccode\u003eglances.conf\u003c/code\u003e file. If an attacker gains write access to this configuration file, they can inject shell operators such as \u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e (chaining), \u003ccode\u003e|\u003c/code\u003e (pipe), or \u003ccode\u003e\u0026gt;\u003c/code\u003e (file redirection) into alert action fields. Because the \u003ccode\u003eglances/actions.py\u003c/code\u003e module fails to pass the \u003ccode\u003eallow_operators\u003c/code\u003e constraint to the \u003ccode\u003esecure_popen()\u003c/code\u003e function in the alert action code path, these injected commands are executed with the privileges of the Glances process. This vulnerability effectively negates the security guarantees provided by the \u003ccode\u003e--disable-config-exec\u003c/code\u003e flag.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker with access to modify the Glances configuration file to achieve arbitrary command execution or unauthorized file writes. This represents a significant escalation of privilege or persistence mechanism, as the commands execute under the security context of the Glances daemon or user process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Glances to the version addressing CVE-2026-68519 as soon as it becomes available.\u003c/li\u003e\n\u003cli\u003eAudit the integrity of the \u003ccode\u003eglances.conf\u003c/code\u003e file across all monitored environments to ensure no unauthorized alert actions have been injected.\u003c/li\u003e\n\u003cli\u003eRestrict write access to the \u003ccode\u003eglances.conf\u003c/code\u003e file to a minimal set of highly privileged administrative users.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected process creation events spawned by the \u003ccode\u003eglances\u003c/code\u003e process, specifically processes launched as children of the main Glances application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T18:46:57Z","date_published":"2026-08-17T18:46:46Z","id":"https://feed.craftedsignal.io/briefs/2026-08-glances-config-exec-bypass/","summary":"Glances versions up to 4.5.5 contain a vulnerability where the --disable-config-exec flag fails to sanitize shell operators in on-alert action commands, allowing arbitrary command execution or file redirection.","title":"Incomplete Fix for Glances Configuration Command Execution Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-glances-config-exec-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Glances (4.5.2 to 4.5.5)","version":"https://jsonfeed.org/version/1.1"}