Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability is fixed in 4.5.5.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU     monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh     list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is     explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised     before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute     arbitrary commands as the OS user running Glances  commonly root on hypervisor hosts. This vulnerability     is fixed in 4.5.5. (CVE-2026-46606)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU
    monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh
    list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is
    explicitly designed to interpret &&, |, and > as shell operators. Because domain names are never sanitised
    before interpolation, any user with the ability to create or rename a KVM/QEMU virtual machine can execute
    arbitrary commands as the OS user running Glances — commonly root on hypervisor hosts. This vulnerability
    is fixed in 4.5.5. (CVE-2026-46606)

ID	Name	Product	Family	Type	Severity
323806	Linux Distros Unpatched Vulnerability : CVE-2026-46606	Nessus	Misc.	Local	high
443765	SCA: security update for glances (GHSA-v5r2-qh84-fjx5)	Tenable Cloud Security	SCA Checks	Local	high
443765	SCA: security update for glances (GHSA-v5r2-qh84-fjx5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-46606

high

Tenable Plugins

high

high

high