CVE-2026-46606

HighCVSS 7.8/10Last modified Jun 25, 2026

Description

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-466077.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-ch CVE-2026-466087.4Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a config CVE-2026-466094.6Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, wh CVE-2026-46617.5The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the CVE-2026-466115.3Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glan CVE-2026-466128.8Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-466149.8Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-466166.1Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member relate CVE-2026-466178.7Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-466186.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-466199.3Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module conc CVE-2026-46627.5The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and includi