PT-2026-25849 · Glance+1 · Glance+1

Restriction · Published 2026-01-01 · Updated 2026-05-08 · CVE-2026-32611

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.3

Description Glances, a system cross-platform monitoring tool, contains a SQL injection issue in the DuckDB export module. The TimescaleDB export module was previously fixed for SQL injection by using parameterized queries, but this fix was not applied to the DuckDB export module. Table and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings, specifically in the DDL construction and table name references. While INSERT values use parameterized queries, the table name and column names are not escaped or parameterized. This issue could lead to data integrity compromise or unauthorized table creation. The vulnerability exists because stat dictionary keys, potentially sourced from external data in future plugins, are used without proper sanitization in SQL queries.

Recommendations Update to Glances version 4.5.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-07160

CVE-2026-32611

GHSA-49G7-2WW7-3VF5

OPENSUSE-SU-2026:10415-1

Affected Products

Glance

Red Os

References · 26

• 🔥 https://github.com/nicolargo/glances/security/advisories/GHSA-49g7-2ww7-3vf5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32611.json · Exploit
• https://github.com/nicolargo/glances/commit/63b7da28895249d775202d639e5531ba63491a5c · Patch
• https://ubuntu.com/security/CVE-2026-32611 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07160 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32611 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32611 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32611 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32611 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32611 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10415-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-49g7-2ww7-3vf5 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32611 · Vendor Advisory
• https://github.com/nicolargo/glances · Note
• https://github.com/nicolargo/glances/releases/tag/v4.5.2 · Note