Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:LSummary
CVE-2026-32611 is a high-severity SQL Injection (CWE-89) vulnerability in Nicolargo Glances. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32611 is a SQL injection vulnerability (CWE-89) affecting Glances, an open-source cross-platform system monitoring tool. The issue resides in the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`), where table names and column names derived from monitoring statistics are directly interpolated into SQL statements using f-strings. Although a prior fix for GHSA-x46r (commit 39161f0) addressed a similar SQL injection in the TimescaleDB export module by adopting parameterized queries and `psycopg.sql` composable objects, the DuckDB module was overlooked. In DuckDB, while INSERT values use parameterized queries with `?` placeholders, the DDL construction and table name references lack proper escaping or parameterization for identifiers. The vulnerability is scored at CVSS 7.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) and was published on 2026-03-18.
A remote unauthenticated attacker (PR:N) with network access (AV:N) can exploit this vulnerability, though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation enables high confidentiality impact (C:H) through data extraction from the DuckDB database, alongside low integrity (I:L) and availability (A:L) impacts within unchanged scope (S:U), such as limited data modification or denial of service on the database.
Advisories and patches, including GHSA-49g7-2ww7-3vf5, recommend upgrading to Glances version 4.5.3, which provides a more complete fix. The remediation commit is available at https://github.com/nicolargo/glances/commit/63b7da28895249d775202d639e5531ba63491a5c, and release notes for v4.5.2 are at https://github.com/nicolargo/glances/releases/tag/v4.5.2, though the full DuckDB fix appears in 4.5.3.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12882
Vulnerability Data
Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`)…
more
was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in network-accessible Glances export module directly matches the definition of exploiting a public-facing application (T1190) to achieve data extraction and limited modification/DoS on the backend database.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of table and column names derived from monitoring statistics before interpolation into DuckDB SQL statements, directly preventing SQL injection exploitation.
Mandates timely identification, reporting, and patching of flaws like the DuckDB SQL injection in Glances, such as upgrading to version 4.5.3.
Provides vulnerability scanning to identify SQL injection vulnerabilities in applications like Glances' DuckDB export module prior to exploitation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.
Early warnings and shared best-practice information help organizations apply the latest remediation techniques against SQL-injection vulnerabilities.
Threat-intelligence feeds that surface new SQL-injection campaigns enable rapid updates to query-construction defenses and detection signatures before exploitation occurs.
Secure-coding rules and security testing phases mandate the use of parameterized queries or equivalent escaping, preventing the construction of dynamic SQL statements from untrusted input.
Language-specific secure coding rules, peer review and SAST together prevent the construction of SQL statements from untrusted data without proper parameterization or escaping.