CVE-2026-35588

Executive Summary

CVE-2026-35588 is a critical vulnerability in the Glances open-source system monitoring tool, affecting its Cassandra export module. The flaw allows an attacker with write access to the glances.conf configuration file to inject arbitrary CQL (Cassandra Query Language) statements by manipulating the keyspace, table, and replication_factor parameters. This can lead to data exfiltration, data manipulation, or denial of service against the monitoring infrastructure. The vulnerability is classified as CWE-89 (SQL Injection) but applied to CQL. The patch is available in version 4.5.4.

Supply Chain & Package Security

Glances is a Python-based package distributed via PyPI. The vulnerability is not in the package supply chain itself but in the configuration handling of the Cassandra export module. Users should ensure they are using a trusted version of the package and verify the integrity of their glances.conf file.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Attack Vector: Local (AV:L) – Requires local access to the configuration file.
• Attack Complexity: Low (AC:L) – No special conditions needed.
• Privileges Required: High (PR:H) – Requires write access to glances.conf.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The impact is confined to the Cassandra database.
• Confidentiality Impact: High (C:H) – Data can be exfiltrated.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – The Cassandra database can be disrupted.

Threat Level: Medium. The vulnerability requires high privileges (write access to configuration), but once exploited, the impact is severe.

Deep Dive & Mechanics

The vulnerability resides in the glances/exports/glances_cassandra/__init__.py file. The module constructs CQL statements by directly interpolating user-supplied configuration values without proper sanitization or parameterization.

Vulnerable Code Path:

1. The glances.conf file is parsed.
2. The keyspace, table, and replication_factor values are read.
3. These values are concatenated into CQL statements like:

   cql = f"CREATE KEYSPACE IF NOT EXISTS {keyspace} WITH replication = {{'class': 'SimpleStrategy', 'replication_factor': {replication_factor}}};"
   

4. An attacker can inject arbitrary CQL commands by including semicolons or other CQL syntax in these fields.

Attack Scenario:

• An attacker gains write access to glances.conf (e.g., via compromised credentials or misconfigured permissions).
• They modify the keyspace value to something like mykeyspace; DROP KEYSPACE existing_keyspace; --.
• When Glances starts or reloads the configuration, the malicious CQL is executed against the Cassandra database.

Vulnerable vs. Patched Code

Vulnerable Code (before 4.5.4):

# glances/exports/glances_cassandra/__init__.py
def create_keyspace(self, keyspace, replication_factor):
    cql = f"CREATE KEYSPACE IF NOT EXISTS {keyspace} WITH replication = {{'class': 'SimpleStrategy', 'replication_factor': {replication_factor}}};"
    self.session.execute(cql)

Patched Code (4.5.4):

# glances/exports/glances_cassandra/__init__.py
def create_keyspace(self, keyspace, replication_factor):
    # Use parameterized queries to prevent injection
    cql = "CREATE KEYSPACE IF NOT EXISTS ? WITH replication = {'class': 'SimpleStrategy', 'replication_factor': ?};"
    self.session.execute(cql, (keyspace, replication_factor))

The patch replaces string interpolation with parameterized queries, which prevents CQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Write access to glances.conf on the target system.
• Glances running with Cassandra export enabled.
• Network access to the Cassandra database.

Exploitation Steps:

1. Modify glances.conf:

   [cassandra]
   host=localhost
   port=9042
   keyspace=mykeyspace; DROP KEYSPACE existing_keyspace; --
   table=mytable
   replication_factor=1
   

2. Restart Glances or trigger a configuration reload.
3. The malicious CQL is executed, dropping the existing keyspace.

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Prevention)

Detection:

• Monitor glances.conf for unauthorized changes.
• Audit Cassandra query logs for unexpected DROP or ALTER statements.
• Use file integrity monitoring (FIM) on glances.conf.

Prevention:

• Restrict write access to glances.conf to only trusted users.
• Upgrade to Glances 4.5.4 or later.
• Implement network segmentation to limit access to the Cassandra database.

Indicators of Compromise (IOCs)

• File: glances.conf with suspicious values in keyspace, table, or replication_factor fields.
• Logs: Cassandra query logs showing unexpected DDL statements (e.g., DROP, ALTER, CREATE) originating from the Glances host.
• Network: Unusual traffic from the Glances host to the Cassandra database, especially if the database is not normally accessed.

Detection Engineering

YARA Rule

rule CVE_2026_35588_Glances_CQL_Injection {
    meta:
        description = "Detects CQL injection attempts in Glances configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35588"
    strings:
        $s1 = "keyspace=" nocase
        $s2 = "table=" nocase
        $s3 = "replication_factor=" nocase
        $injection = /(DROP|ALTER|CREATE|INSERT|DELETE|UPDATE|TRUNCATE)\s/i
    condition:
        all of ($s*) and $injection
}

Sigma Rule

title: CQL Injection via Glances Configuration
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential CQL injection attempts in Glances configuration files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: 'glances.conf'
        EventID: 11  # File creation or modification
    keywords:
        - 'keyspace='
        - 'table='
        - 'replication_factor='
    injection:
        - 'DROP '
        - 'ALTER '
        - 'CREATE '
        - 'INSERT '
        - 'DELETE '
        - 'TRUNCATE '
    condition: selection and injection
falsepositives:
    - Legitimate administrative changes to Glances configuration
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 9042 (msg:"CVE-2026-35588 Glances CQL Injection Attempt"; flow:to_server,established; content:"DROP|20|KEYSPACE"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Glances to version 4.5.4 or later.
2. Review and restrict permissions on glances.conf to only necessary users.
3. Audit Cassandra logs for any suspicious activity.

Long-term Measures:

• Implement file integrity monitoring for critical configuration files.
• Use parameterized queries in all database interactions.
• Conduct regular security reviews of open-source dependencies.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valters.it.

{/* [Security Hash: 76EB497D6927454505F122E7] */}