Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
Summary
The Cassandra export module (glances/exports/glances_cassandra/__init__.py) interpolates keyspace, table, and replication_factor configuration values directly into CQL statements without validation. A user with write access to glances.conf can redirect all monitoring data to an attacker-controlled Cassandra keyspace.
Vulnerable Code
# Line 80
f"CREATE KEYSPACE {self.keyspace} WITH "
f"replication = {{ 'class': 'SimpleStrategy', 'replication_factor': '{self.replication_factor}' }}"
# Line 94
f"CREATE TABLE {self.table} (plugin text, time timeuuid, stat map<text,float>, PRIMARY KEY (plugin, time)) WITH CLUSTERING ORDER BY (time DESC)"
# Line 112
stmt = f"INSERT INTO {self.table} (plugin, time, stat) VALUES (?, ?, ?)"Steps to Reproduce
- Configure
glances.confwith malicioustablevalue:
[cassandra]
host = 127.0.0.1
port = 9042
keyspace = glances
table = attacker_ks.captured_stats- Create attacker keyspace in Cassandra
- Run
glances --export cassandra - All monitoring data is written to
attacker_ks.captured_statsinstead of the legitimate table
Confirmed output:
INSERT stmt: INSERT INTO attacker_ks.captured_stats (plugin, time, stat) VALUES (?, ?, ?)
Legitimate table row count: 0
Attacker table row count: 1
[CONFIRMED] plugin=cpu, stat={'user': 50.0}Impact
All exported monitoring data (CPU, memory, network, disk I/O) is silently redirected to an attacker-controlled Cassandra keyspace — both data exfiltration and data loss.
Proposed Fix
import re
def _validate_cql_identifier(name: str) -> str:
if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_.]*$', name):
raise ValueError(f"Invalid CQL identifier: {name!r}")
return name
# In __init__(): validate before use
self.keyspace = _validate_cql_identifier(self.keyspace)
self.table = _validate_cql_identifier(self.table)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | glances | < 4.5.4 | 4.5.4 |
References
- https://github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160
- https://github.com/nicolargo/glances/commit/e41b665576f9fd5374e3152078726cc59a01e48c
- https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7
- https://nvd.nist.gov/vuln/detail/CVE-2026-35588
- https://github.com/nicolargo/glances
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L- Weakness (CWE)
CWE-89- Platform
- Python (PyPI)
- Package
glances- Disclosed
- 21.04.2026
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2177 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-grp3-h8m8-45p7 - CC BY 4.0
Vulnerability history: glances
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 26
- First → latest
- 07.2021 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 19
- Medium 6
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 25
-
Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.