CVE-2026-68519: Glances RCE Vulnerability

CVE-2026-68519 Overview

CVE-2026-68519 is a command injection vulnerability [CWE-78] in Glances, an open-source cross-platform system monitoring tool. Versions prior to 4.5.6 fail to honor the --disable-config-exec flag for on-alert action commands. The GlancesActions.run() method in glances/actions.py invokes secure_popen() with shell operators enabled, which permits configured redirection, command chaining, and pipes to execute when an alert triggers. An attacker who can influence the Glances configuration file can execute arbitrary shell commands on the monitoring host. The issue is fixed in version 4.5.6.

Critical Impact
Shell metacharacters in on-alert action definitions execute in the context of the Glances process, bypassing the intended --disable-config-exec safeguard.

Affected Products

Glances versions prior to 4.5.6
glances/actions.py module (GlancesActions.run())
Deployments using on-alert action commands in the Glances configuration

Discovery Timeline

2026-08-17 - CVE-2026-68519 published to NVD
2026-08-17 - Last updated in NVD database

Technical Details for CVE-2026-68519

Vulnerability Analysis

Glances supports triggering user-defined shell commands when a monitored metric crosses an alert threshold. The --disable-config-exec command-line flag is intended to suppress execution of any config-driven commands, providing a hardening option for shared or multi-tenant deployments. The GlancesActions.run() method did not consult this flag before dispatching on-alert action commands. It called secure_popen() with shell operator handling enabled, so pipes (|), redirections (>, <), and command chaining (;, &&, ||) in the configured action string were interpreted by the shell rather than treated as literal arguments.

An attacker who can write to or influence the Glances configuration file, or who can supply a malicious configuration during deployment, can inject shell metacharacters into an action definition. When the associated alert fires, the injected payload runs with the privileges of the Glances process. Because the flaw is a logic gap in the action dispatch path, the operator's mitigation flag provides no protection until the upstream fix in 4.5.6.

Root Cause

The root cause is a missing precondition check in GlancesActions.run(). The class did not retain a reference to args, so it could not evaluate args.disable_config_exec before invoking secure_popen(). The patch introduces self.args = args in __init__ so the runtime check can gate execution of configured action commands.

Attack Vector

Exploitation requires local access with sufficient privileges to modify the Glances configuration or supply a crafted configuration file. Once an alert threshold is crossed for a monitored metric, the malicious action string is passed to a shell with operators enabled, executing the attacker's payload. This is a local privilege-context abuse rather than a remote network attack.

python

     def __init__(self, args=None):
         """Init GlancesActions class."""
+        # Keep a reference to args to honor --disable-config-exec (see run())
+        self.args = args
+
         # Dict with the criticality status
         # - key: stat_name
         # - value: criticality

Source: GitHub commit 5c07c0d — the patch stores args on the instance so run() can honor --disable-config-exec before invoking secure_popen().

Detection Methods for CVE-2026-68519

Indicators of Compromise

Glances configuration files containing shell metacharacters (|, ;, &&, >, <) inside action definitions for monitored stats.
Unexpected child processes spawned by the Glances process, particularly shells (sh, bash) invoking utilities such as curl, wget, nc, or python.
Modification timestamps on glances.conf or user-level ~/.config/glances/glances.conf that do not correspond to administrative change windows.

Detection Strategies

Inventory Glances installations and flag any version earlier than 4.5.6.
Parse Glances configuration files and alert on action or action_repeat directives that include shell operators.
Monitor process lineage for child processes whose parent is the Glances binary, correlating spawn events with recent alert threshold crossings.

Monitoring Recommendations

Enable command-line auditing (auditd on Linux, EDR telemetry elsewhere) for processes launched by Glances.
Track file integrity on Glances configuration paths to detect unauthorized modifications.
Review Glances logs for repeated alert triggers that coincide with anomalous outbound network activity.

How to Mitigate CVE-2026-68519

Immediate Actions Required

Upgrade Glances to version 4.5.6 or later on every host running the agent or server components.
Audit existing glances.conf files for action directives containing shell metacharacters and remove any unauthorized entries.
Restrict write permissions on Glances configuration files to trusted administrative accounts only.

Patch Information

The fix is available in Glances 4.5.6. See the GitHub Release v4.5.6 and the GitHub Security Advisory GHSA-59fj-m2j6-hcxh for release notes and advisory details. The upstream code change is documented in GitHub commit 5c07c0d.

Workarounds

Run Glances without a configuration file, or with a configuration that contains no action directives, until the patch is applied.
Execute Glances under a dedicated low-privilege service account to reduce the impact of arbitrary command execution.
Enforce configuration file ownership and mode 0600 so unprivileged users cannot introduce malicious action commands.

bash

# Verify installed Glances version and upgrade
glances --version
pip install --upgrade 'glances>=4.5.6'

# Restrict configuration file permissions
chown root:root /etc/glances/glances.conf
chmod 0600 /etc/glances/glances.conf

# Audit action directives for shell operators
grep -nE '^\s*action(_repeat)?\s*=.*[|;&><`$]' /etc/glances/glances.conf