Skip to content

glances

v4.5.5 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 1mo Monitoring & Metrics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 5 known CVEs

Topics

monitoring multi-platform python rest restful-api system
+2 more
cli web

Affected surfaces

rce_ssrf deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

Release v4.5.5 patches critical security flaws such as arbitrary file write, command execution, DNS rebinding, CORS wildcard fallback, insecure pickle deserialization, and KVM/QEMU injection.

Why it matters: The release fixes high‑severity CVEs (CVSS scores implied by severity ≥85) that enable arbitrary code execution or data exfiltration; operators should upgrade immediately to mitigate risk.

Summary

AI summary

Fixes critical security vulnerabilities including arbitrary file write, command execution, DNS rebinding, CORS wildcard fallback, pickle deserialization, and KVM/QEMU injection.

Changes in this release

Security Critical

Corrects arbitrary file write and command execution in AMP configuration (CVE-2026-53925)

Corrects arbitrary file write and command execution in AMP configuration (CVE-2026-53925)

Source: llm_adapter@2026-06-13

Confidence: high

 —
Security Critical

Patches insecure pickle deserialization enabling arbitrary code execution (CVE-2026-46607)

Patches insecure pickle deserialization enabling arbitrary code execution (CVE-2026-46607)

Source: llm_adapter@2026-06-13

Confidence: high

 —
Security Critical

Remediates command injection via KVM/QEMU VM domain names (CVE-2026-46606)

Remediates command injection via KVM/QEMU VM domain names (CVE-2026-46606)

Source: llm_adapter@2026-06-13

Confidence: high

 —
Security High

Fixes XML-RPC server DNS rebinding via missing Host header validation (CVE-2026-46611)

Fixes XML-RPC server DNS rebinding via missing Host header validation (CVE-2026-46611)

Source: llm_adapter@2026-06-13

Confidence: high

 —
Security High

Corrects XML-RPC CORS fallback to wildcard (CVE-2026-46608)

Corrects XML-RPC CORS fallback to wildcard (CVE-2026-46608)

Source: llm_adapter@2026-06-13

Confidence: high

 —
Feature Medium

Adds CPU limit support for Docker, Podman, and LXD containers

Adds CPU limit support for Docker, Podman, and LXD containers

Source: llm_adapter@2026-06-13

Confidence: high

 —
Feature Medium

Adds GPU monitoring for ARM / RaspberryPi platforms

Adds GPU monitoring for ARM / RaspberryPi platforms

Source: llm_adapter@2026-06-13

Confidence: high

 —
Feature Medium

Adds CPU and memory meters for GPU in Quicklook plugin

Adds CPU and memory meters for GPU in Quicklook plugin

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Feature Medium

Displays process and temperature on NVIDIA Jetson (Tegra) integrated GPUs

Displays process and temperature on NVIDIA Jetson (Tegra) integrated GPUs

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Bugfix Medium

Fixes crash when using --sparkline option

Fixes crash when using --sparkline option

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Restores LOAD 1/5/15min values in VMs section

Restores LOAD 1/5/15min values in VMs section

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Corrects AMD GPU detection for multi‑digit DRM card numbers

Corrects AMD GPU detection for multi‑digit DRM card numbers

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Allows REST status check without authentication

Allows REST status check without authentication

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Bugfix Medium

Corrects regression in Disk I/O reporting

Corrects regression in Disk I/O reporting

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Bugfix Low

Reduces latency of /api/4/containers endpoint with many Docker containers

Reduces latency of /api/4/containers endpoint with many Docker containers

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Bugfix Low

Ensures auto_unit stays within limits to keep columns aligned

Ensures auto_unit stays within limits to keep columns aligned

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Bugfix Low

Uses boolean values for logging configuration

Uses boolean values for logging configuration

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Bugfix Low

Fixes filesystem alias handling for mixed‑case mount points

Fixes filesystem alias handling for mixed‑case mount points

Source: granite4.1:30b@2026-06-13-audit

Confidence: high

 —
Full changelog

Bugs corrected:

  • /api/4/containers stays ~4-5s with ~60 Docker containers #3559
  • Crash when using --sparkline #3547
  • VMs section does not show LOAD 1/5/15min values #3535
  • Fix AMD GPU detection for multi-digit DRM card numbers #3578
  • Keep auto_unit within limits, so columns stay aligned #3558
  • Rest status check shouldn't require auth #3544
  • Logging configuration to use boolean value #3536
  • Fix filesystem aliases for mixed-case mount points #3532
  • Regression in Disk I/O reporting #3546

Enhancements:

  • Add meter for CPU and MEM of GPU in the Quicklook plugin #1711
  • Add cpu limit to docker, podman and lxd containers #3557
  • GPU Monitoring (ARM / RaspberryPi) #1048
  • GPU plugin: display proc and temperature on NVIDIA Jetson (Tegra) integrated #3580

Security patches:

  • Arbitrary file write and command execution in AMP command configuration - Correct CVE-2026-53925
  • XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack - Correct CVE-2026-46611
  • XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard - Correct CVE-2026-46608
  • Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution - Correct CVE-2026-46607
  • Command Injection via KVM/QEMU VM Domain Names in virsh.py - Correct CVE-2026-46606

Continious integration, refactoring and documentation:

  • Add top 10 slowest plugins summary at end of --issue output #3572
  • Update documentation for hide/show #3546
  • Refactor: Improve load_additional_plugins Maintainability, Safety, and Plugin Discovery #3561
  • Refactor: Reduce Cyclomatic complexity of __display_top Issue #3549
  • Refactor: Reduce Cyclomatic complexity of display_popup() #3542
  • Refactor: Compute spacing
  • Refactor: handle quicklook required for display²
  • Refactor: Get plugin Width & get stats summary
  • Add unit test to containers/docker plugin

Packaging:

  • Glances Alpine Docker images are now based on Alpine 3.24
  • Glances Ubuntu Docker images are now based on Ubuntu 26.04

Thanks to all the contributors for this version: 20086080, cswaltzinger, Sergio LIVI,
Adi, Ariel Eli, Gabriel St. Angel, Jack Harper, Tarrailt, William Wu, Yan and lawrence3699.

Security Fixes

  • CVE-2026-53925 — Arbitrary file write and command execution in AMP command configuration
  • CVE-2026-46611 — XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
  • CVE-2026-46608 — XML‑RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard
  • CVE-2026-46607 — Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution
  • CVE-2026-46606 — Command Injection via KVM/QEMU VM Domain Names in virsh.py
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track glances

Get notified when new releases ship.

Sign up free

About glances

Glances an Eye on your system. A top/htop alternative for GNU/Linux, BSD, Mac OS and Windows operating systems.

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]