Medium severity6.3NVD Advisory· Published Apr 21, 2026· Updated Apr 22, 2026
CVE-2026-35588
CVE-2026-35588
Description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (glances/exports/glances_cassandra/__init__.py) interpolates keyspace, table, and replication_factor configuration values directly into CQL statements without validation. A user with write access to glances.conf can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
glancesPyPI | < 4.5.4 | 4.5.4 |
Affected products
3- ghsa-coords2 versions
< 4.5.4+ 1 more
- (no CPE)range: < 4.5.4
- (no CPE)range: < 4.5.4-1.1
Patches
Vulnerability mechanics
References
5- github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160nvdPatchWEB
- github.com/nicolargo/glances/commit/e41b665576f9fd5374e3152078726cc59a01e48cnvdPatchWEB
- github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-grp3-h8m8-45p7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-35588ghsaADVISORY
News mentions
0No linked articles in our index yet.