CVE-2026-35588: Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values

Summary

The Cassandra export module (glances/exports/glancescassandra/init.py) interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write access to glances.conf can redirect all monitoring data to an attacker-controlled Cassandra keyspace.

Vulnerable Code

python Line 80 f"CREATE KEYSPACE {self.keyspace} WITH " f"replication = {{ 'class': 'SimpleStrategy', 'replicationfactor': '{self.replicationfactor}' }}"

Line 94 f"CREATE TABLE {self.table} (plugin text, time timeuuid, stat map<text,float>, PRIMARY KEY (plugin, time)) WITH CLUSTERING ORDER BY (time DESC)"

Line 112 stmt = f"INSERT INTO {self.table} (plugin, time, stat) VALUES (?, ?, ?)"

Steps to Reproduce

1. Configure glances.conf with malicious table value: ini [cassandra] host = 127.0.0.1 port = 9042 keyspace = glances table = attackerks.capturedstats 2. Create attacker keyspace in Cassandra 3. Run glances --export cassandra 4. All monitoring data is written to attackerks.capturedstats instead of the legitimate table

Confirmed output: INSERT stmt: INSERT INTO attackerks.capturedstats (plugin, time, stat) VALUES (?, ?, ?) Legitimate table row count: 0 Attacker table row count: 1 [CONFIRMED] plugin=cpu, stat={'user': 50.0}

Impact

All exported monitoring data (CPU, memory, network, disk I/O) is silently redirected to an attacker-controlled Cassandra keyspace — both data exfiltration and data loss.

Proposed Fix

python import re

def validatecqlidentifier(name: str) -> str: if not re.match(r'^[a-zA-Z][a-zA-Z0-9.]$', name): raise ValueError(f"Invalid CQL identifier: {name!r}") return name

In init(): validate before use self.keyspace = validatecqlidentifier(self.keyspace) self.table = validatecqlidentifier(self.table)

!PoC