CVE-2026-32611

CVE-2026-32611 is a high-severity vulnerability in Nicolargo Glances with a CVSS 3.x base score of 7.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-89.

Key facts

Description

Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.

Frequently asked questions

What is CVE-2026-32611?
Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.
How severe is CVE-2026-32611?
CVE-2026-32611 has a CVSS 3.x base score of 7.0, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity low, and availability low.
Is CVE-2026-32611 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-32611?
CVE-2026-32611 affects Nicolargo Glances. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-32611?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-32611 have an EU (EUVD) identifier?
Yes. CVE-2026-32611 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12882.
When was CVE-2026-32611 published?
CVE-2026-32611 was published on 2026-03-18 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Nicolargo Glances

All CVEs affecting Nicolargo Glances →

Other CWE-89 (SQL Injection) vulnerabilities

Browse all CWE-89 (SQL Injection) vulnerabilities →