CVE-2026-46611: Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
(updated )
The Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. CVE-2026-32632 (patched in 4.5.2) added TrustedHostMiddleware to the REST/WebUI server; the MCP server has had equivalent protection since 4.5.1. The XML-RPC server received neither fix and has no allowed-hosts configuration key. Combined with the unrestricted Access-Control-Allow-Origin: * header (see companion advisory for CVE-2026-33533 and its incomplete fix), an attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim’s browser.
References
- github.com/advisories/GHSA-w856-8p3r-p338
- github.com/nicolargo/glances
- github.com/nicolargo/glances/releases/tag/v4.5.5
- github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338
- github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2026-2498.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-46611
- pypi.org/project/glances
Code Behaviors & Features
Detect and mitigate CVE-2026-46611 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →