CVE-2026-30930 Overview
Glances is an open-source system cross-platform monitoring tool. A SQL injection vulnerability exists in versions prior to 4.5.1 within the TimescaleDB export module. The module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names.
Critical Impact
Attackers can achieve SQL injection through attacker-controlled system data like process names, mount points, or container names, potentially leading to data exfiltration, modification, or destruction in connected TimescaleDB databases.
Affected Products
- Glances versions prior to 4.5.1
- Systems using the TimescaleDB export module
- Environments monitoring untrusted process names, filesystem mount points, network interfaces, or container names
Discovery Timeline
- 2026-03-10 - CVE CVE-2026-30930 published to NVD
- 2026-03-11 - Last updated in NVD database
Technical Details for CVE-2026-30930
Vulnerability Analysis
This vulnerability affects the TimescaleDB export functionality in Glances. The root cause lies in improper input validation when constructing SQL queries from system monitoring data. The application's normalize() method attempts to sanitize string values by wrapping them in single quotes, but critically fails to escape single quotes that may be embedded within the data itself.
Since Glances monitors various system metrics including process names, filesystem mount points, network interface names, and container names, an attacker with the ability to control any of these values can inject malicious SQL code. For example, a malicious process name containing SQL metacharacters could be crafted to break out of the string context and execute arbitrary SQL commands against the connected TimescaleDB instance.
The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which is one of the most common and dangerous vulnerability types in software applications.
Root Cause
The vulnerability stems from the normalize() method's incomplete string sanitization. While the method wraps string values in single quotes to create SQL string literals, it fails to escape embedded single quotes within the input data. This classic SQL injection pattern allows attackers to terminate the string literal prematurely and inject arbitrary SQL syntax.
Attack Vector
The attack requires local access to the system being monitored by Glances. An attacker can exploit this vulnerability by creating system artifacts with malicious names, such as:
- Creating processes with SQL injection payloads in their names
- Mounting filesystems with crafted mount point paths
- Configuring network interfaces with malicious names
- Creating Docker/container names containing SQL injection strings
When Glances collects and exports this monitoring data to TimescaleDB, the unsanitized values are incorporated directly into SQL queries, allowing the injected code to execute against the database.
The vulnerability mechanism works as follows: when the TimescaleDB export module processes system data, string values are passed through the normalize() method which wraps them in single quotes. However, if the input contains a single quote character, the attacker can escape the string context. For example, a process named test'; DROP TABLE stats; -- would result in the quote being closed prematurely, allowing subsequent SQL commands to execute.
For detailed technical analysis, see the GitHub Security Advisory.
Detection Methods for CVE-2026-30930
Indicators of Compromise
- Unusual process names containing SQL syntax or special characters (single quotes, semicolons, comment indicators)
- Unexpected filesystem mount points with SQL injection patterns in their paths
- Container or network interface names with suspicious string patterns
- Anomalous SQL query patterns in TimescaleDB logs
- Database errors indicating malformed SQL queries from Glances exports
Detection Strategies
- Monitor for processes with names containing SQL metacharacters such as single quotes, semicolons, or SQL keywords
- Implement database query logging and alerting for anomalous SQL patterns from Glances connections
- Review TimescaleDB logs for SQL syntax errors that may indicate injection attempts
- Deploy application-level monitoring to detect unexpected data patterns in Glances export operations
Monitoring Recommendations
- Enable detailed query logging on TimescaleDB instances receiving Glances data
- Implement alerts for SQL errors originating from Glances export connections
- Monitor system for creation of processes, mount points, or containers with suspicious naming patterns
- Review Glances configuration to identify all active export modules and their database connections
How to Mitigate CVE-2026-30930
Immediate Actions Required
- Upgrade Glances to version 4.5.1 or later immediately
- If upgrade is not immediately possible, disable the TimescaleDB export module until patched
- Review TimescaleDB logs for evidence of exploitation attempts
- Audit systems for suspicious process names, mount points, or container names that may contain SQL injection payloads
- Restrict database permissions for the Glances TimescaleDB user to minimum required privileges
Patch Information
The vulnerability has been fixed in Glances version 4.5.1. The fix addresses the SQL injection issue by properly escaping embedded single quotes in the normalize() method before constructing SQL queries.
Patch Resources:
Workarounds
- Disable the TimescaleDB export module if not critical to operations until upgrade can be performed
- Implement network segmentation to restrict Glances database connectivity
- Apply strict database user permissions to limit potential damage from SQL injection
- Monitor and sanitize system artifact names (processes, mount points, containers) at the OS level to prevent malicious input
- Consider using alternative export modules that do not have this vulnerability
# Configuration example - Disable TimescaleDB export in glances.conf
# Edit the Glances configuration file
# Locate and comment out or remove the TimescaleDB section
[timescaledb]
# Disable by commenting out the host configuration
# host=localhost
# port=5432
# user=glances
# password=glances
# db=glances
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
