Glances, an open‑source system monitoring tool, interpolated its "keyspace", "table", and "replication_factor" configuration values directly into CQL statements without validation. The result was a classic CQL injection vulnerability, where a user with write access to the configuration file could insert arbitrary CQL parameters and redirect all monitoring output to a Cassandra keyspace of the attacker’s choosing. This bypasses the intended namespace isolation, potentially exposing sensitive system metrics, allowing an attacker to inject or corrupt monitoring data, and could serve as an avenue for data exfiltration or misuse of resources. The weakness maps to CWE‑89 (SQL Injection) in the context of Cassandra’s CQL.

The flaw exists in all Glances releases prior to version 4.5.4, distributed under the nicolargo:glances vendor designation. Any deployment that uses a configuration file with write permissions granted to local users is vulnerable.

With a CVSS score of 6.3, the vulnerability is considered medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The attack requires write access to glances.conf, which is typically limited to the privileged user running Glances or a user who can modify configuration files. Whether the configuration file is exposed to remote users depends on the deployment; however, the primary attack vector is local intrusion. Once the attacker writes malicious configuration values, Glances will send monitoring data to the attacker’s Cassandra instance, achieving the goals outlined above.