CVE-2026-35588

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.

• CWE-89

• https://github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160Patch
• https://github.com/nicolargo/glances/commit/e41b665576f9fd5374e3152078726cc59a01e48cPatch
• https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7Exploit, Mitigation, Vendor Advisory
• https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7Exploit, Mitigation, Vendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35582Emissary is a P2P based data-driven workflow engine. In vers…8.8
• CVE-2026-35583Emissary is a P2P based data-driven workflow engine. Prior t…5.3
• CVE-2026-35584FreeScout is a free help desk and shared inbox built with PH…6.5
• CVE-2026-35585File Browser is a file managing interface for uploading, del…7.2
• CVE-2026-35586pyLoad is a free and open-source download manager written in…6.8
• CVE-2026-35587Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-35589nanobot is a personal AI assistant. Versions prior to 0.1.5 …9.3
• CVE-2026-3559Philips Hue Bridge HomeKit Accessory Protocol Static Nonce A…8.1
• CVE-2026-35590libvips is a fast image processing library with low memory n…6.8
• CVE-2026-35591libvips is a fast image processing library with low memory n…7
• CVE-2026-35592pyLoad is a free and open-source download manager written in…6.5
• CVE-2026-35593Trilium Notes is an open-source, cross-platform hierarchical…6.8