Most recent entries from all

BREW-glances-CVE-2026-35588 — Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

2026-10-03T21:08:29.558634+00:00

Affected: Homebrew: glances

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.

CVE-2026-35588 — Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

2026-10-03T21:08:29.558701+00:00

Affected: nicolargo glances

GHSA-grp3-h8m8-45p7 — Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

2026-10-03T21:08:29.558748+00:00

Affected: PyPI: glances

## Summary

The Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace.

## Vulnerable Code

```python # Line 80 f"CREATE KEYSPACE {self.keyspace} WITH " f"replication = {{ 'class': 'SimpleStrategy', 'replication_factor': '{self.replication_factor}' }}"

# Line 94 f"CREATE TABLE {self.table} (plugin text, time timeuuid, stat map, PRIMARY KEY (plugin, time)) WITH CLUSTERING ORDER BY (time DESC)"

# Line 112 stmt = f"INSERT INTO {self.table} (plugin, time, stat) VALUES (?, ?, ?)" ```

## Steps to Reproduce

1. Configure `glances.conf` with malicious `table` value: ```ini [cassandra] host = 127.0.0.1 port = 9042 keyspace = glances table = attacker_ks.captured_stats ``` 2. Create attacker keyspace in Cassandra 3. Run `glances --export cassandra` 4. All monitoring data is written to `attacker_ks.captured_stats` instead of the legitimate table

**Confirmed output:** ``` INSERT stmt: INSERT INTO attacker_ks.captured_stats (plugin, time, stat) VALUES (?, ?, ?) Legitimate table row count: 0 Attacker table row count: 1 [CONFIRMED] plugin=cpu, stat={'user': 50.0} ```

## Impact

All exported monitoring data (CPU, memory, network, disk I/O) is silently redirected to an attacker-controlled Cassandra keyspace — b…