CVE-2026-30930 is a critical SQL injection (CVSS 9.8) in the TimescaleDB export module of Glances before 4.5.1. Monitoring values such as process names are placed into queries without escaping. Upgrade to Glances 4.5.1 or later, or disable that export.
What's affected
Glances versions before 4.5.1 are affected when the TimescaleDB export is in use. The fix is in 4.5.1.
How to check if you're exposed
Print the installed version:
glances --version
pip show glances
Then check your Glances configuration file for a [timescaledb] section and for --export timescaledb in service units or scripts. If the export is not enabled, the vulnerable code path is not in use.
What to do now
- Upgrade Glances to 4.5.1 or later.
- If you cannot upgrade, stop using the TimescaleDB export until you can.
- Use a database account for the export that can only insert into its own tables.
- Review the database for unexpected tables, rows or roles.
Why it matters
The weakness class is CWE-89, SQL injection. The export builds queries by joining strings. The normalize method wraps text values in single quotes but does not escape a single quote inside the value, so a value can end the string early and add its own SQL.
What makes this unusual is the source of the data. The record says attacker controlled values such as process names, filesystem mount points, network interface names or container names can carry it. Monitoring data feels trusted, but names on a host can be set by whoever runs software there. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if I do not use TimescaleDB export?
The flaw is in that export module. Without it enabled you are not on the vulnerable path, but a routine upgrade is still sensible.
Why does a process name matter?
Any user who can start a process can choose its name. If that name goes into a query unescaped, it becomes input to the database.
Sources
Last reviewed: 19 October 2026.
