Arbitrary Command Execution Vulnerability in Glances Monitoring Tool
CVE-2026-46606

7.8HIGH

Key Information:

Vendor

Nicolargo

Status
Glances
Vendor
CVE Published:
25 June 2026

What is CVE-2026-46606?

Glances, an open-source cross-platform monitoring tool, contains a vulnerability that allows users with the ability to control KVM/QEMU virtual machines to execute arbitrary commands. This occurs due to the direct usage of unvalidated VM domain names from virsh output in command templates processed by secure_popen(). As these domain names are not sanitized, an attacker could exploit this flaw to run commands as the OS user running Glances, typically root on hypervisor systems. The issue is addressed in version 4.5.5, which implements necessary sanitization measures.

Affected Version(s)

glances < 4.5.5

References

https://github.com/nicolargo/glances/security/advisories/...
x_refsource_CONFIRM
https://github.com/nicolargo/glances/releases/tag/v4.5.5
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.