Read the docs
TI-2026-23755 Aliases CVE-2026-30930GHSA-x46r-mf5g-xpr6

Glances has SQL Injection via Process Names in TimescaleDB Export

Priority HIGH 67CWE-89Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed glances (nicolargo): 4.5.1Glances (PyPI): 4.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nicolargoglancesbefore 4.5.14.5.1Patch availableCNA
—Glances (PyPI)before 4.5.14.5.1Patch availableGHSA-x46r-mf5g-xpr6
  • glances Vendornicolargo Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • Glances (PyPI) Vendor— Affected before 4.5.1 Fixed in 4.5.1 Patch available GHSA-x46r-mf5g-xpr6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*before 4.5.1Vulnerablenicolargo
  • cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:* Versions before 4.5.1 Vulnerable ·nicolargo

Remediation

  • Fix · CNA glances (nicolargo) Fixed in 4.5.1
  • Fix · GHSA-x46r-mf5g-xpr6 Glances (PyPI) Fixed in 4.5.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30930
  2. 2026-10-03 Alias added: GHSA-x46r-mf5g-xpr6

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-25142 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` CVSS 3.1CRITICAL 9.1
  • TI-2026-25106 Glances exposes the REST API without authentication CVSS 4.0HIGH 8.7
  • TI-2026-27083 Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS CVSS 4.0HIGH 7.7
  • TI-2026-25120 Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements CVSS 3.1CRITICAL 9.1
  • TI-2026-25118 Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials CVSS 3.1HIGH 7.5
  • TI-2026-25143 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences