CVE-2026-46611
Description
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.
Summary dbcve.org
The Glances XML-RPC server (glances -s) fails to validate the HTTP Host header, enabling DNS rebinding attacks. An attacker can host a malicious page that uses the victim's browser to make cross-origin requests to the Glances server, bypassing Same-Origin Policy via DNS rebinding, and exfiltrate the complete system monitoring dataset including CPU, memory, disk, and network stats.
Mitigation
Upgrade to Glances version 4.5.5 or later which implements HTTP Host header validation. If immediate upgrade is not possible, restrict network access to the XML-RPC server or place it behind a reverse proxy with strict Host header validation.