CVE-2026-68519: Glances incomplete fix in alert action command execution

CVE-2026-68519 · Severity: high · CVSS 4 · Published 2026-08-17

Glances is a system monitoring tool that can be configured with alert actions that execute commands when performance thresholds are crossed. The `--disable-config-exec` flag is supposed to prevent shell operators like file redirection (>) and command chaining (&&) from being interpreted in these commands. However, version 4.5.5 fails to apply this protection to alert action commands while correctly applying it to other command types. An attacker who can edit the configuration file can write arbitrary files or chain commands at the privilege level of the glances process when an alert triggers.

Technologies: glances (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-68519 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68519 being exploited in the wild.
How severe is CVE-2026-68519?
High severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?
glances (PyPI) <= 4.5.5, ECOSYSTEM:introduced=0,fixed=4.5.6.
Is there a fix for CVE-2026-68519?
Yes. glances (PyPI): upgrade to 4.5.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68519 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-68519?
Check whether you run glances (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • glances (PyPI): upgrade to 4.5.6 or later
    pip install "glances>=4.5.6"

Technical details

This is an incomplete fix of a prior security hardening (GHSA-3vwc-qwhc-3mj7). The vulnerability exists in `glances/actions.py` line 111, where `secure_popen(cmd_full)` is called without the `allow_operators` parameter that controls interpretation of shell metacharacters. In contrast, AMP modules in `glances/amps/default/__init__.py:69` and `glances/amps/systemv/__init__.py:60` correctly pass `allow_operators=self.allow_operators()` to respect the `--disable-config-exec` setting. The root cause is that the hardening was inconsistently applied across code paths that both read commands from the configuration file. An attacker with write access to the glances configuration file can inject shell operators (>, &&, |) into alert action commands, and these will be interpreted by the shell when the corresponding alert condition is met. The fix requires passing the `allow_operators` parameter consistently from `GlancesActions.run()` to `secure_popen()` in the alert action path. A patch is available in version 4.5.6.

Affected products

  • nicolargo Glances <= 4.5.5

Identifiers

  • CVE-2026-68519
  • GHSA-59fj-m2j6-hcxh
  • PYSEC-2026-3665

Timeline

  • 2026-08-17: disclosed
  • 2026-08-01: patched: Version 4.5.6 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.