CVE-2026-35588: Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
The Cassandra export module (glances/exports/glances_cassandra/__init__.py) interpolates keyspace, table, and replication_factor configuration values directly into CQL statements without validation. A user with write access to glances.conf can redirect all monitoring data to an attacker-controlled Cassandra keyspace.
References
- github.com/advisories/GHSA-grp3-h8m8-45p7
- github.com/nicolargo/glances
- github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160
- github.com/nicolargo/glances/commit/e41b665576f9fd5374e3152078726cc59a01e48c
- github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7
- nvd.nist.gov/vuln/detail/CVE-2026-35588
Code Behaviors & Features
Detect and mitigate CVE-2026-35588 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →