CVE-2026-68519

Executive Summary

CVE-2026-68519 is an OS command injection vulnerability in Glances, an open-source cross-platform system monitoring tool, affecting versions prior to 4.5.6. The flaw exists in GlancesActions.run() in glances/actions.py, where the --disable-config-exec safeguard is ignored for on-alert action commands, and secure_popen() is invoked with shell operators enabled. When an alert is triggered, configured redirection, command chaining, or pipes can execute arbitrary shell commands in the context of the Glances service.

Technical Analysis

The vulnerability is classified as CWE-78 — Improper Neutralization of Special Elements used in an OS Command. Glances includes an actions subsystem that allows operators to define commands to run when certain monitoring alerts fire. This functionality is designed to support dynamic remediation or notification actions.

The product provides the --disable-config-exec option to prevent commands defined in the configuration from being executed. The NVD description indicates a logic flaw: this option is not honored for the on-alert action execution path. In particular, GlancesActions.run() ignores the flag when processing on-alert action commands and passes the configured command string to secure_popen() with shell operators enabled.

Because shell operators are enabled in the vulnerable code path, a configured action containing characters such as ;, |, >, <, &, or command substitution constructs can escape the intended command boundary. The attacker does not necessarily need to be remote; the prerequisite is that an on-alert action command containing shell metacharacters is present and an alert condition is triggered.

Attack surface:

• Local attacker with the ability to modify Glances configuration files or influence alert-triggering conditions in environments where action commands are used.
• Potentially an indirect network trigger if an alert condition can be remotely induced and the on-alert command string contains attacker-influenced content.
• Monitoring hosts that expose the Glances web interface or API are also more likely to be reachable by attackers, although the vulnerable code path itself is in the local action-execution logic.

No public proof-of-concept, Nuclei template, or exploit code was provided in the intelligence data. No CISA KEV entry is available. No CVSS score or vector has been published, and EPSS has not yet been scored by FIRST.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification
   An adversary identifies a host running Glances, typically through network scanning of monitoring ports, web dashboard banners, or default service fingerprints. More importantly, the attacker determines whether Glances uses on-alert action commands and whether the service account has elevated privileges.

2. Triggering the vulnerability class
   The vulnerable condition requires an on-alert action to be executed while Glances is configured with command strings that contain shell operators. This can be achieved by:

   • An attacker with local access or configuration write access injecting shell metacharacters into an action command.
   • An attacker coercing a specific monitoring alert (e.g., CPU, memory, disk, or service state alarm) so that a pre-configured on-alert command is invoked.
   • A configuration supplied through an automated deployment pipeline that unknowingly includes malicious shell syntax.

3. Payload / execution method
   Because GlancesActions.run() ignores --disable-config-exec and calls secure_popen() with shell operators enabled, the configured command string is interpreted by the shell. A configuration value such as a command followed by redirection, a pipe, or a command-chaining operator would result in the injection and execution of arbitrary operating system commands at alert time.

4. Post-exploitation impact
   If Glances runs as root or an administrator account, arbitrary command execution results in full host compromise. Even as an unprivileged user, the attacker gains the ability to read monitoring data, access configuration files containing credentials, modify local files, install persistence mechanisms, or pivot from the compromised monitoring host into the broader network.

Impact Assessment

No CVSS information has been published for CVE-2026-68519. The absence of a score must not be interpreted as low severity; OS command injection vulnerabilities routinely result in arbitrary command execution.

Affected systems are Glances installations prior to 4.5.6 that use on-alert actions and contain shell operators in action configuration strings. The blast radius includes the monitoring host itself and any systems or credentials accessible to the Glances service account. Since monitoring agents often run with elevated privileges to collect system telemetry, successful exploitation may escalate to full host compromise. In enterprise environments, a compromised monitoring host can be used as a pivot point for lateral movement.

Given the affected component is a widely used open-source system monitoring tool, exposure may be significant in on-premises and containerized environments. The lack of a published CVSS score and patch-source confidence reduces the ability to prioritize the issue automatically; organizations should treat it as a high-priority command execution risk.

Detection Guidance

The following detection rules are intended as use cases, not verified production signatures. They should be customized to local logging capabilities.

Sigma Rule

title: Glances On-Alert Action OS Command Injection Detection
id: 7c1f0a2b-8e2c-4f4b-9e5d-1f6a2c9d3e5b
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/glances'
      - '/glances.py'
      - '/python3'
    CommandLine|contains:
      - ';'
      - '|'
      - '>'
      - '&'
  condition: selection
falsepositives:
  - Legitimate administrator-defined Glances action commands using shell syntax
  - Scheduled monitoring scripts launched by other parent processes
level: high

YARA Rule

rule Glances_Action_Injection_CVE_2026_68519 {
    meta:
        description = "Detects strings associated with Glances on-alert action command injection"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-68519"
        cve = "CVE-2026-68519"
        author = "Threat Intelligence Team"
    strings:
        $a = "GlancesActions.run" ascii wide nocase
        $b = "secure_popen" ascii wide nocase
        $c = "--disable-config-exec" ascii wide nocase
        $d = "on-alert" ascii wide nocase
    condition:
        2 of them
}

Suricata IDS Rule

Network-only detection is difficult because the vulnerability executes locally when an alert fires. The following Suricata rule detects generic command-injection probing against a Glances web interface and should be complemented by host-based process monitoring.

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-68519 Glances command injection probing indicator";
    flow:established,to_server;
    http.header;
    content:"Glances";
    nocase;
    http.uri;
    content:";";
    nocase;
    http.uri;
    content:"|";
    nocase;
    pcre:"/[\x3b\x7c\x26]/Ui";
    classtype:attempted-admin;
    sid:202668519;
    rev:1;)

Elastic Detection

process where process.parent.name in ("glances", "glances.py")
    and process.command_line regex ".*(;|\||&|>).*"

Splunk SPL Query

(index=linux OR index=windows)
(sourcetype=linux_audit OR sourcetype=WinEventLog:Security)
| where match(cmdline, "(;|\||&|>)") AND lower(parent_process) LIKE "%glances%"
| table _time, host, user, parent_process, process_name, cmdline

Wazuh OSSEC Rule

<group name="glances,command_injection,">
    <rule id="100685" level="10">
        <decoded>ossec</decoded>
        <field name="process">glances</field>
        <regex>\;|\||\&|\></regex>
        <description>CVE-2026-68519: Glances on-alert action OS command injection attempt detected</description>
        <group>command_injection,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4, meaning no patch evidence was confirmed from a tracked source. The NVD description states the issue is fixed in Glances 4.5.6, but because the patch source is unconfirmed, organizations should verify availability before relying on the fix.

1. Immediate mitigations

   • Do not rely on --disable-config-exec to protect on-alert actions; the vulnerable code path bypasses this flag.
   • Audit all Glances action configuration files and remove any on-alert commands that contain shell metacharacters such as ;, |, >, or &.
   • Run the Glances service under a least-privileged operating system account rather than as root or admin.
   • Restrict access to Glances configuration files and management interfaces to authorized administrators only.
   • Monitor process execution on hosts running Glances and investigate any unexpected child processes spawned by the Glances process.

2. Patch / upgrade steps

   • Upgrade to Glances 4.5.6 or later if the patched version is confirmed by the maintainer.
   • Verify the software hash/signature after upgrade to ensure supply-chain integrity.
   • If the patched version cannot be sourced or verified, treat the system as unpatched and apply compensating controls.

3. Long-term hardening

   • Deploy host-based detection rules (EDR, Elastic, Splunk, Wazuh) that alert on child process creation from the Glances service account.
   • Enforce application allowlisting to prevent the Glances service from executing unauthorized binaries.
   • Segment monitoring infrastructure so that compromise of a monitoring host does not directly expose production systems.
   • Require code review and validation of any Glances configuration file changes, especially alert actions.
   • Monitor vendor channels and NVD updates for more complete patch and CVE information.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-68519
• CWE-78: OS Command Injection: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1059: Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CISA Known Exploited Vulnerabilities: no current listing for CVE-2026-68519
• Vendor advisory: not supplied in the source intelligence data; CNA title empty. No known exploit-in-the-wild or threat actor campaigns were identified at the time of this report.