CVE-2026-32611 is a high severity SQL injection in the DuckDB export module of Glances, the system monitoring tool, scored CVSS 7.0. Table and column names built from monitoring data were placed into SQL with f-strings. Version 4.5.2 changed it and the record says 4.5.3 completes the fix, so upgrade to 4.5.3 or later.
What's affected
Glances is a Python package. The NVD record describes the problem in glances/exports/glances_duckdb/init.py. An earlier fix had moved the TimescaleDB exporter to parameterized queries but missed the DuckDB exporter.
The Glances 4.5.2 release notes list this CVE among eight security fixes. The NVD record adds that version 4.5.3 provides a more complete fix. I did not confirm the exact first affected version, so treat anything before 4.5.3 as in scope.
The issue concerns the DuckDB export. If you never enable that export, this code path is not part of your setup.
How to check if you're exposed
Check the installed version:
pip show glances
Then see whether the DuckDB exporter is enabled. Look in your glances.conf for a duckdb section, and look at your service or container command line for an export option naming duckdb.
grep -n -i duckdb /etc/glances/glances.conf ~/.config/glances/glances.conf
If neither shows DuckDB, you likely do not use the affected module, but upgrading is still sensible because the same release fixes seven other issues.
What to do now
- Upgrade Glances to 4.5.3 or later with pip, or update your container image tag.
- Read the 4.5.2 breaking changes before you roll out. The release notes say the web server now checks the Host header, the default CORS policy is stricter, and some API fields are redacted for unauthenticated callers.
- If you use a reverse proxy or a different origin, add the allowed_hosts and cors_origins keys the release notes describe.
- Disable the DuckDB export on hosts where you do not need it.
- Do not expose the Glances web server to untrusted networks.
Plan the rollout, because the 4.5.2 release notes list behavior changes that can break dashboards.
- Host header checks are now enforced on the built-in web server. Requests whose Host header is not localhost or 127.0.0.1 get an HTTP 400 unless you list the allowed values in the allowed_hosts key of the outputs section of glances.conf.
- The default CORS policy is now restrictive, and the wildcard is removed. Front ends on another origin need the cors_origins key.
- Sensitive fields on the args and config API endpoints are redacted for callers who have not authenticated.
Test these in staging first if you serve Glances through a reverse proxy or a custom front end.
Why it matters
The class is CWE-89, SQL injection. The record notes that DuckDB insert values already used placeholders, but the statements that create tables and name columns did not escape the identifiers. Placeholders cannot protect names, so names have to be validated or quoted properly.
This is a good example of an incomplete fix. When one module is repaired for a class of bug, sibling modules that share the pattern need the same review. The record's KEV flag is false.
The practical risk depends on whether anyone can influence the strings that become table or column names.
Quick check
Do bound parameters protect table names?
No. Placeholders only carry values. Identifiers such as table and column names must be checked against an allowlist or quoted with the database library's own helpers.
Is 4.5.2 enough?
The release notes list the fix in 4.5.2, but the NVD record says 4.5.3 provides a more complete fix. Go to 4.5.3 or later.
Sources
Last reviewed: 19 October 2026.
