CVE-2026-68519: Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen() with shell operators enabled, allowing configured redirection, command chaining, or pipes to execute when an alert triggers. This issue is fixed in 4.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
glancesto a version that resolves this vulnerability.Fixed in 4.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68519?
CVE-2026-68519 has a risk rating of 53.
What is the main issue with CVE-2026-68519?
CVE-2026-68519 involves an incomplete fix of CVE-2026-53925 where the `--disable-config-exec` flag does not cover on-alert action commands.
How do I fix CVE-2026-68519?
To fix CVE-2026-68519, upgrade Glances to version 4.5.6 or later.
What are the potential consequences of CVE-2026-68519?
CVE-2026-68519 could lead to OS command injection due to the invocation of shell operators.
Which version of Glances is affected by CVE-2026-68519?
Versions of Glances prior to 4.5.6 are affected by CVE-2026-68519.