CVE-2026-32632: Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
(updated )
Glances recently added DNS rebinding protection for the MCP endpoint, but the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent host allowlist.
As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin.
This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target.
References
- github.com/advisories/GHSA-hhcg-r27j-fhv9
- github.com/nicolargo/glances
- github.com/nicolargo/glances/commit/5850c564ee10804fdf884823b9c210eb954dd1f9
- github.com/nicolargo/glances/releases/tag/v4.5.2
- github.com/nicolargo/glances/security/advisories/GHSA-hhcg-r27j-fhv9
- nvd.nist.gov/vuln/detail/CVE-2026-32632
Code Behaviors & Features
Detect and mitigate CVE-2026-32632 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →