Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-68519, describes an incomplete fix for a previous issue where the --disable-config-exec flag in Glances did not properly prevent shell operator execution in on-alert action commands. The analysis of the provided commit 5c07c0d96423e9d5b9de71dd92e3717c66f504bd confirms this. The glances/actions.py file, specifically the GlancesActions.run method, was identified as the vulnerable component. In the vulnerable version, this method called secure_popen with only the command string (cmd_full) as an argument. The patch introduces a new method, allow_operators(), which checks the disable_config_exec flag, and then passes its result to secure_popen via the allow_operators keyword argument. The absence of this allow_operators argument in the vulnerable code meant that secure_popen would default to allowing shell operators, thus enabling command injection when an alert triggered and executed a specially crafted command from the configuration. Therefore, GlancesActions.run is the function that failed to enforce the security control.
GlancesActions.runglances/actions.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| glances | pip | <= 4.5.5 | 4.5.6 |