CVE-2026-68519

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6

Description In the glances/actions.py file, the GlancesActions.run() function fails to respect the --disable-config-exec flag when processing on-alert action commands. This occurs because the function invokes secure popen() without disabling shell operators. Consequently, if an alert triggers, the system may interpret shell operators such as > (file redirection), && (command chaining), or | (pipes) defined in the configuration file. This allows for arbitrary file writes or command chaining with the privileges of the Glances process, bypassing the security hardening intended by the --disable-config-exec flag.

Recommendations Update Glances to version 4.5.6. As a temporary workaround, avoid using shell operators like >, &&, or | in on-alert action commands within the configuration file.