Glances CVE-2026-30930

TimescaleDB export module must be explicitly configured and enabled in Glances configuration (non-default setting in most installations). Attacker requires local access to the monitored system with privileges to create processes with arbitrary names OR ability to spawn containers/virtual machines with crafted names that Glances monitors. Exploitation is limited to environments where Glances actively exports to TimescaleDB - standard Glances installations using default console/web UI without database export are NOT vulnerable. The local attack vector (AV:L) and no privileges required (PR:N) mean any local user account suffices if TimescaleDB export is enabled, but the attacker cannot exploit this remotely without first gaining local system access through other means.

Real-world risk is MODERATE despite the 7.3 CVSS score. The CVSS vector (AV:L/AC:L/PR:N) indicates local attack vector with low complexity and no privileges required, yielding high confidentiality, integrity, and availability impact on the database. However, exploitation requires specific conditions: TimescaleDB export must be enabled (non-default configuration in most deployments), and the attacker needs local access to create processes/containers with malicious names. The EPSS score of 0.02% (4th percentile) suggests negligible real-world exploitation activity. Proof-of-concept code exists (E:P in CVSS vector), lowering the barrier for technical attackers. SSVC assessment: Exploitation is POSSIBLE (POC available), AUTOMATABLE with local access, and TOTAL technical impact (arbitrary SQL execution can compromise the entire monitoring database). Priority depends heavily on whether TimescaleDB export is actively used - for most Glances deployments using default exporters, this represents lower risk. For environments with TimescaleDB integration AND untrusted local users/containers, this is HIGH priority.

A local attacker with access to create processes or Docker containers launches a process named "malicious' OR 1=1; DROP TABLE metrics; --" on the monitored system. Glances' monitoring cycle collects this process name and passes it to the TimescaleDB export module. The vulnerable normalize() method wraps the name in single quotes without escaping, resulting in SQL injection when the query executes against the TimescaleDB backend. The attacker achieves arbitrary SQL execution with the database credentials used by Glances, potentially exfiltrating monitoring data, tampering with metrics, or destroying time-series tables. Proof-of-concept exploit code exists per CVSS E:P metric.