Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data to an attacker-controlled Cassandra keyspace. Version 4.5.4 contains a fix.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Glances, CQL Injection, #CVE-2026-35588 (Critical) https://dailycve.com/glances-cql-injection-cve-2026-35588-critical/
Post summary
The tweet announces a critical CQL injection vulnerability (CVE‑2026‑35588) affecting Glances, with a link to further details, but offers no PoC, active exploitation, or patch information.
CVE-2026-35588 Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init__.py`)… https://www.cve.org/CVERecord?id=CVE-2026-35588
Post summary
The text only references CVE‑2026‑35588 for Glances with a link to the CVE record, providing no additional technical or exploit details.
CVE-2026-35588 CQL Injection in Glances Cassandra Export Module Prior to Version 4.5.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35588
Post summary
The entry reports a CQL injection vulnerability (CVE‑2026‑35588) in the Glances Cassandra Export Module for versions before 4.5.4, indicating that upgrading to 4.5.4 resolves the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nicolargo | glances | - | - | - |