An unauthenticated SQL injection vulnerability in the Glances DuckDB export module poses a significant risk to data integrity and system security.

The application fails to properly sanitize table and column names within the DuckDB export module, allowing for SQL injection via f-string interpolation. This flaw is accessible to unauthenticated remote attackers.

The ability to execute unauthorized SQL commands against the backend database can lead to unauthorized data exposure, modification, or potential service disruption. Given the CVSS score of 7.0, this vulnerability is classified as High severity, necessitating prompt remediation to prevent compromise of monitoring data and underlying database infrastructure.

Immediate Action: Update the Glances package to version 4.5.3 or later to ensure the DuckDB export module is fully protected against SQL injection.

Proactive Monitoring: Review database query logs for anomalous syntax, unexpected table access, or structural changes that deviate from standard monitoring operations.

Compensating Controls: If an immediate update is not feasible, disable the DuckDB export module or restrict network access to the Glances service to authorized management segments only.

Public Exploit Available: Unknown.

The presence of an SQL injection vulnerability in a widely used monitoring tool represents a high risk to environment visibility and data security. Administrators should prioritize updating to the patched version immediately to neutralize this vector. Consistent with good security hygiene, ensure that all monitoring tools are isolated from untrusted network segments to minimize exposure.