CVE-2026-46606

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

• CWE-78

• https://github.com/nicolargo/glances/releases/tag/v4.5.5
• https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5
• https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5

Published

Jun 25, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4660HashiCorp’s go-getter library up to v1.8.5 may allow arbitra…7.5
• CVE-2026-46600Parsing an invalid SVCB or HTTPS RR can panic when the size …7.5
• CVE-2026-46601The webp decoder can panic when processing a VP8 chunk with …7.5
• CVE-2026-46602The TIFF decoder does not set a limit on the size of tiles i…7.5
• CVE-2026-46604The TIFF decoder can panic when decoding an invalid image wi…7.5
• CVE-2026-46605Incomplete authorization by Apache ActiveMQ server before ve…4.3
• CVE-2026-46607Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-46608Glances is an open-source system cross-platform monitoring t…7.4
• CVE-2026-46609Umbraco is an ASP.NET CMS. From version 14.0.0 to before ver…4.6
• CVE-2026-4661The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sal…7.5
• CVE-2026-46611Glances is an open-source system cross-platform monitoring t…5.3
• CVE-2026-46612Fission is an open-source, Kubernetes-native serverless fram…8.8