CVE-2026-46607

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.5

Description Insecure deserialization occurs in glances/outdated.py because the load cache() function uses pickle.load() to read a version-check cache file. This file is stored at predictable, world-accessible paths such as ~/.cache/glances/glances-version.db or $XDG CACHE HOME/glances/glances-version.db. Since no integrity check, signature verification, or format validation is performed before deserialization, an attacker with write access to these paths can plant a malicious pickle file. This allows for arbitrary code execution as the OS user running Glances when the application starts with version checking enabled, which is the default setting. This issue can be exploited in shared multi-user hosts, compromised containers sharing volumes, or via symlink race conditions.

Recommendations Update Glances to version 4.5.5. As a temporary mitigation, disable the version check feature by setting check update = false in the configuration. Restrict the permissions of the Glances cache directory to 0700 to prevent unauthorized write access.