CVE-2026-35588

Name	CVE-2026-35588
Description	Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1134645

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glances (PTS)	bookworm	3.3.1.1+dfsg-1	vulnerable
	trixie	4.3.1+dfsg-1	vulnerable
	forky, sid	4.5.3.2+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glances	source	(unstable)	(unfixed)			1134645

Notes

https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7
https://github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160 (v4.5.4)