CVE-2026-32611

Executive Summary

CVE-2026-32611 is a critical SQL injection vulnerability in the Glances open-source system monitoring tool, specifically within the DuckDB export module (glances/exports/glances_duckdb/__init__.py). The vulnerability arises because table names and column names derived from monitoring statistics are directly interpolated into SQL statements using f-strings, without proper sanitization or parameterization. While the TimescaleDB export module was previously patched (GHSA-x46r), the DuckDB module was overlooked. An attacker who can influence the monitoring data (e.g., by controlling a monitored hostname or process name) can inject arbitrary SQL commands, leading to data exfiltration, modification, or denial of service. The CVSS score is 7.0 (High), and no public exploit code is currently available. The patch is available in version 4.5.3.

Supply Chain & Package Security

Glances is a Python package distributed via PyPI. This vulnerability affects the DuckDB export module, which is an optional dependency. Users who have installed Glances with the DuckDB extra (pip install glances[duckdb]) are vulnerable. The supply chain risk is moderate, as the vulnerability is in a specific export module and requires the attacker to influence monitoring data. However, if Glances is deployed in a CI/CD pipeline or monitoring infrastructure, the impact could be significant.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely if the attacker can influence the monitoring data (e.g., via a compromised host).
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are the same.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Full database write access.
• Availability (A): High (H) – Database can be corrupted or deleted.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Threat Level: High (7.0)

Deep Dive & Mechanics

The vulnerability is in the DuckDB export module. When Glances collects monitoring data (e.g., hostname, process names, CPU metrics), it constructs SQL statements to create tables and insert data. The table names and column names are derived from the monitoring data itself. For example, if a hostname contains a SQL injection payload, it will be directly interpolated into the CREATE TABLE statement.

Vulnerable Code (simplified):

# glances/exports/glances_duckdb/__init__.py (vulnerable)
table_name = f"stats_{hostname}"
cursor.execute(f"CREATE TABLE IF NOT EXISTS {table_name} (timestamp TIMESTAMP, cpu FLOAT)")

If hostname is "; DROP TABLE stats; --, the resulting SQL becomes:

CREATE TABLE IF NOT EXISTS "; DROP TABLE stats; --" (timestamp TIMESTAMP, cpu FLOAT)

This allows arbitrary SQL execution.

Patched Code (version 4.5.3):

# glances/exports/glances_duckdb/__init__.py (patched)
from duckdb import Identifier
table_name = Identifier(f"stats_{hostname}")
cursor.execute(f"CREATE TABLE IF NOT EXISTS {table_name} (timestamp TIMESTAMP, cpu FLOAT)")

The Identifier class properly escapes and quotes the identifier, preventing injection.

Vulnerable vs. Patched Code

Vulnerable (pre-4.5.3):

# Vulnerable: f-string interpolation of identifiers
table_name = f"stats_{hostname}"
cursor.execute(f"CREATE TABLE IF NOT EXISTS {table_name} (timestamp TIMESTAMP, cpu FLOAT)")

Patched (4.5.3):

# Patched: Use duckdb.Identifier for safe quoting
from duckdb import Identifier
table_name = Identifier(f"stats_{hostname}")
cursor.execute(f"CREATE TABLE IF NOT EXISTS {table_name} (timestamp TIMESTAMP, cpu FLOAT)")

Exploitation & Lab Setup

Red Team

Prerequisites:

• Glances with DuckDB export enabled (version < 4.5.3).
• Ability to influence a monitored metric (e.g., hostname, process name).

Exploitation Steps:

1. Set up a Glances instance with DuckDB export.
2. Craft a malicious hostname containing SQL injection payload.
3. Trigger Glances to collect data from the malicious host.
4. Observe the injected SQL being executed.

Example Payload (hostname):

"; DROP TABLE stats; --

Lab Setup:

# Install vulnerable version
pip install glances==4.5.2[duckdb]

# Run Glances with DuckDB export
glances --export duckdb --export-duckdb-database /tmp/test.db

# Simulate a malicious hostname (e.g., via /etc/hostname or environment variable)
export HOSTNAME='"; DROP TABLE stats; --'
glances --export duckdb --export-duckdb-database /tmp/test.db

Blue Team

Detection:

• Monitor for unusual SQL errors in Glances logs.
• Look for unexpected table drops or schema changes in DuckDB databases.
• Use the Sigma rule below to detect suspicious hostnames or process names.

Mitigation:

• Immediately upgrade to Glances 4.5.3 or later.
• If upgrade is not possible, disable the DuckDB export module.
• Validate and sanitize all monitoring data before it reaches the export module.

Indicators of Compromise (IOCs)

• File: /tmp/test.db (or any DuckDB database file) with unexpected schema changes.
• Log: Glances log entries containing SQL errors like syntax error at or near ";".
• Network: Unusual outbound connections from the Glances host to a database server (if DuckDB is used remotely).
• Process: Glances process with high CPU or memory usage due to SQL injection attempts.

Detection Engineering

YARA Rule

rule CVE_2026_32611_Glances_DuckDB_SQLi {
    meta:
        description = "Detects SQL injection attempts in Glances DuckDB export module"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-32611"
    strings:
        $sqli1 = /CREATE TABLE IF NOT EXISTS ["']?;/
        $sqli2 = /DROP TABLE/
        $sqli3 = /--/
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: Glances DuckDB SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts in Glances DuckDB export module (CVE-2026-32611)
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: glances
detection:
    selection:
        EventID: 1001
        Message|contains:
            - 'syntax error at or near'
            - 'DROP TABLE'
            - '; --'
    condition: selection
falsepositives:
    - Legitimate use of special characters in hostnames (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-32611 Glances DuckDB SQL Injection Attempt"; flow:to_server; content:"CREATE TABLE IF NOT EXISTS"; nocase; content:";"; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Glances 4.5.3 or later.
• If upgrade is not possible, disable the DuckDB export module by removing the --export duckdb flag.

Long-term:

• Implement input validation for all monitoring data before it reaches export modules.
• Use parameterized queries and safe identifier quoting (e.g., duckdb.Identifier) for all SQL operations.
• Conduct a security audit of all export modules in Glances.

Workaround:

• Use a different export module (e.g., CSV, JSON) until the upgrade is applied.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert