Is CVE-2026-46606 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46606 being exploited in the wild.

How severe is CVE-2026-46606?

High severity, with a CVSS score of 7.8, published 25 June 2026.

Which products and versions are affected?

glances (PyPI) < 4.5.5, ECOSYSTEM:introduced=0,fixed=4.5.5.

Is there a fix for CVE-2026-46606?

Yes. glances (PyPI): upgrade to 4.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46606 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-46606?

Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46606: nicolargo Glances command injection in virsh.py

Q: Which products and versions are affected?

glances (PyPI) < 4.5.5, ECOSYSTEM:introduced=0,fixed=4.5.5.

Q: Is there a fix for CVE-2026-46606?

Yes. glances (PyPI): upgrade to 4.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46606 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-46606?

Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46606 · Severity: high · CVSS 7.8 · Published 2026-06-25

Glances is a popular open-source tool used to monitor the performance of servers and virtual machines. A security flaw in its KVM/QEMU monitoring component allows a user with the ability to name or rename virtual machines to execute unauthorized commands on the host system. Because Glances often runs with high privileges (such as root) to collect system data, an attacker could potentially take full control of the server, access sensitive data, or disrupt operations.

Technologies: glances (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-46606 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46606 being exploited in the wild.
How severe is CVE-2026-46606?: High severity, with a CVSS score of 7.8, published 25 June 2026.
Which products and versions are affected?: glances (PyPI) < 4.5.5, ECOSYSTEM:introduced=0,fixed=4.5.5.
Is there a fix for CVE-2026-46606?: Yes. glances (PyPI): upgrade to 4.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46606 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-46606?: Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

glances (PyPI): upgrade to 4.5.5 or later
```
pip install "glances>=4.5.5"
```

Technical details

An OS command injection vulnerability (CWE-78) exists in the Glances KVM/QEMU monitoring engine within `glances/plugins/vms/engines/virsh.py`. The application reads VM domain names from `virsh list --all` and interpolates them into f-string command templates processed by `secure_popen()`. Because `secure_popen()` is designed to interpret shell operators like `&&`, `|`, and `>`, and domain names are not sanitized, an attacker can craft a VM name containing these operators to achieve arbitrary code execution. This requires the attacker to have local privileges to create or rename KVM/QEMU virtual machines (e.g., membership in the `libvirt` group). The vulnerability is fixed in version 4.5.5 by improving input handling.

Affected products

nicolargo Glances < 4.5.5

Identifiers

CVE-2026-46606
GHSA-v5r2-qh84-fjx5
PYSEC-2026-2497

Timeline

2026-06-13: patched: Version 4.5.5 released
2026-06-25: disclosed: CVE-2026-46606 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.