CVE-2026-46608: Glances XML-RPC CORS Bypass Vulnerability – Patch Guide

Technical summary

CVE-2026-46608 is a CORS misconfiguration vulnerability in Glances versions prior to 4.5.5. The XML-RPC server implementation introduced a configurable cors_origins allowlist in version 4.5.3 as mitigation for CVE-2026-33533. However, the validation logic contains a flaw: whenever the cors_origins configuration contains more than one entry, the code silently reverts to Access-Control-Allow-Origin: * (wildcard), effectively disabling the intended allowlist restriction. This permits any origin to issue CORS simple requests to the /RPC2 endpoint and receive full system monitoring telemetry. The vulnerability is rooted in CWE-183 (Permissive Allowlist Entry) and CWE-942 (Permissive Cross-domain Policy with Untrusted Domains), and is fixed in version 4.5.5.

Business impact

Organizations running Glances as a monitoring server risk exposure of real-time system state information to unauthenticated remote attackers. Exposed metrics include CPU utilization, memory consumption, disk usage, running processes, network activity, and other operational data that can inform further reconnaissance or targeted attacks. In regulated environments, unauthorized disclosure of system performance data may trigger compliance violations. Attackers can correlate this telemetry with other reconnaissance to identify high-value targets, plan timing for intrusions, or detect when security controls are actively running. The impact is amplified if Glances instances are internet-facing or accessible from untrusted networks.

Affected systems

Glances versions 4.5.3 and 4.5.4 are affected. Any deployment using the -s (XML-RPC server) flag with a cors_origins configuration containing two or more entries is vulnerable, regardless of the administrator's intent to restrict access. Version 4.5.5 and later contain the fix. Earlier versions (prior to 4.5.3) are not affected by this specific vulnerability, as they did not include the configurable CORS allowlist feature.

Exploitability

Exploitability is straightforward and requires no authentication, special tools, or user interaction. An attacker simply hosts a malicious webpage with JavaScript that makes CORS requests to the target Glances /RPC2 endpoint. The vulnerability requires the victim to visit the attacker's site while network conditions allow the request to reach the Glances server (e.g., both attacker and victim on the same network, or Glances exposed to the public internet). The CVSS score of 7.4 (HIGH) reflects the combination of network accessibility, low attack complexity, and high confidentiality impact, offset by the requirement for user interaction (the victim must visit the attacker-controlled page).

Remediation

Upgrade Glances to version 4.5.5 or later immediately. Verify the upgrade by checking the version output and confirming that the CORS configuration no longer exhibits the fallback behavior. As a temporary mitigation pending upgrade, administrators can disable the XML-RPC server entirely (-s flag) if not actively in use, or implement network-level access controls (firewall rules, IP whitelisting) to restrict which hosts can reach the Glances server port. However, these mitigations do not replace the patched code and should only be considered temporary.

Patch guidance

Download and deploy Glances 4.5.5 from the official repository. Verify the installed version matches or exceeds 4.5.5 by running 'glances --version'. Test the CORS allowlist behavior post-upgrade by confirming that requests from unapproved origins receive appropriate blocking responses, and that configured origins continue to function correctly. Restart any running Glances processes to ensure the new code is loaded.

Detection guidance

Monitor access logs for /RPC2 endpoint requests originating from unexpected origins or referrer headers. Implement network intrusion detection signatures that flag CORS preflight requests (OPTIONS) or simple requests to /RPC2 from external IPs if the Glances server should only be internal. Check Glances configuration files to identify instances with cors_origins containing multiple entries; these are vulnerable and should be prioritized for patching. Telemetry collection from Glances itself can reveal whether system metrics have been accessed via unexpected request patterns or timing anomalies.

Why prioritize this

This vulnerability should be patched with high priority because it bypasses an explicit security control that administrators configured, creating a false sense of security. Organizations that intentionally set up CORS restrictions are likely monitoring sensitive infrastructure and expect that restriction to hold. The confluence of easy exploitability, high confidentiality impact, and breach of trust in the security feature makes this a strong candidate for rapid patching. The fact that it affects versions only recently released (4.5.3–4.5.4) suggests it may not yet be widely exploited, providing a narrow window for proactive defense.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) is driven by network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction required (UI:R), and changed scope with high confidentiality impact (S:C, C:H). The user interaction component reflects the need for a victim to visit an attacker's webpage; however, this is a low bar in practice, as phishing or accidental discovery can easily satisfy it. Integrity and availability are not impacted, keeping the score from reaching CRITICAL range. The real-world risk is amplified by the false sense of security that a configured allowlist creates.

Frequently asked questions