Glances EUVD-2026-60305

The attacker must have write access to the Glances configuration file (glances.conf) on the local system - this is the primary trust boundary identified in the advisory. Glances must be running with the --disable-config-exec flag (the flag that operators enable specifically to harden config-driven command execution), otherwise operators are already permitted by design and this is expected behavior. An alert threshold configured in glances.conf (e.g., user_critical for CPU) must be crossed; this can be engineered locally or may trigger naturally under load. Exploitation is strictly local (AV:L); remote exploitation is not possible without first obtaining config file write access through another vulnerability. The impact ceiling is the privilege of the Glances process - typically a service account, not necessarily root. Limiting factors: requires local presence, config write privilege, and alert threshold satisfaction.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:N) with score 7.1 accurately represents the constrained threat model: local access is required, and the attacker must hold write privileges over the Glances configuration file (PR:H). The AT:P metric reflects that alert threshold crossing is a prerequisite - this can be engineered by a local attacker (e.g., CPU stress test) or may occur organically. The primary risk is to environments where operators have explicitly enabled --disable-config-exec as a security boundary, believing it prevents config-file-driven command execution holistically; this CVE nullifies that assurance for the alert action path. No EPSS data was provided in the input; no KEV listing exists, indicating no confirmed widespread exploitation. A benign PoC is publicly documented in the advisory (GHSA-59fj-m2j6-hcxh), confirming technical exploitability. Real-world risk is moderate: exploitation requires both local config file write access and the ability to trigger an alert, limiting opportunistic attacks, but presents a meaningful privilege escalation or persistence vector in shared or multi-tenant monitoring deployments.

A local attacker with write access to glances.conf modifies a CPU threshold alert action to include a shell redirect, for example user_critical_action=id > /tmp/pwned, then induces CPU load to trigger the CRITICAL alert threshold. When GlancesActions.run() fires, secure_popen() receives allow_operators=True (the unpatched default) and interprets the > operator, writing the output of id to /tmp/pwned at the privilege of the Glances process - despite --disable-config-exec being active. A benign variant of this scenario is documented as the PoC in GHSA-59fj-m2j6-hcxh.