Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0)     addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use     parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module     (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of     vulnerability: table names and column names derived from monitoring statistics are directly interpolated     into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?`     placeholders), the DDL construction and table name references do not escape or parameterize identifier     names. Version 4.5.3 provides a more complete fix. (CVE-2026-32611)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0)
    addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use
    parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module
    (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of
    vulnerability: table names and column names derived from monitoring statistics are directly interpolated
    into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?`
    placeholders), the DDL construction and table name references do not escape or parameterize identifier
    names. Version 4.5.3 provides a more complete fix. (CVE-2026-32611)

ID	Name	Product	Family	Type	Severity
302961	Linux Distros Unpatched Vulnerability : CVE-2026-32611	Nessus	Misc.	Local	critical
438833	SCA: security update for Glances (GHSA-49g7-2ww7-3vf5)	Tenable Cloud Security	SCA Checks	Local	critical
438833	SCA: security update for Glances (GHSA-49g7-2ww7-3vf5)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-32611

critical

Tenable Plugins

critical

critical

critical