CVE-2026-46606
Description
From CVE.org
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.
Statement
This vulnerability is rated as Important severity because local authenticated users capable of creating or modifying virtual machine names can achieve arbitrary code execution under the privileges of the monitoring daemon, which frequently executes with root access on hypervisor systems. While exploitation requires existing privileges to define or alter libvirt guests, the resulting compromise grants full administrative control over the underlying host. Glances is not shipped in core Red Hat Enterprise Linux and is only distributed through Extra Packages for Enterprise Linux (EPEL) or Fedora repositories.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
