CVE-2026-46611: Glances XML-RPC DNS Rebinding Vulnerability

Technical summary

The vulnerability stems from improper Host header validation in Glances' XML-RPC server implementation (glances/server.py). DNS rebinding attacks exploit this by resolving an attacker-controlled domain to the victim's localhost address in a second lookup, after the browser's same-origin policy check has already passed on the first lookup. An attacker-hosted webpage can then make XMLRPC method calls to the Glances server running on the victim's machine, bypassing network isolation assumptions. The attack succeeds because the server does not restrict requests based on the Host header, treating any request to the bound IP/port as valid. This is classified under CWE-346 (Origin Validation Error) and CWE-350 (Reliance on Reverse DNS Resolution).

Business impact

For organizations using Glances for system monitoring and performance analytics, this vulnerability poses a data exposure risk. An attacker gaining access to the full monitoring dataset can infer system load, running services, resource constraints, and operational patterns—useful reconnaissance for follow-up attacks. The impact is mitigated by the requirement for user interaction and the typical deployment model (Glances often runs on isolated machines or internal networks), but environments where monitoring staff access untrusted websites while working on monitored systems face direct risk. The CVSS score of 5.3 (Medium) reflects high confidentiality impact offset by the attack complexity and user interaction requirement.

Affected systems

Glances versions prior to 4.5.5 are affected. The vulnerability only manifests when the XML-RPC server mode is explicitly enabled (-s flag); default Glances installations using the standard monitoring interface are not affected. Organizations running Glances in server mode for remote monitoring or API-driven integrations should prioritize assessment.

Exploitability

Exploitation requires DNS rebinding capability and user interaction—specifically, the victim must visit an attacker-controlled website while having the Glances server running on their machine. The attacker does not need network access to the Glances server itself; DNS rebinding bypasses that boundary. However, the attack is not trivial to execute reliably, depending on DNS TTL handling and browser behavior. Public exploit code is not widely available, and this vulnerability is not on the CISA Known Exploited Vulnerabilities list, suggesting limited real-world active exploitation to date.

Remediation

Upgrade Glances to version 4.5.5 or later. The fix implements proper Host header validation in the XML-RPC server, rejecting requests with Host headers that do not match the expected server identity. Organizations unable to patch immediately should disable the XML-RPC server mode (-s flag) if not actively required, or restrict network access to the Glances server to trusted sources using a firewall or network segmentation.

Patch guidance

Apply the update to Glances 4.5.5 or later. Verify the update by checking the Glances version (glances --version) after installation. If using package managers (pip, apt, homebrew, etc.), ensure the repository index is refreshed before installing. No special configuration changes are required post-patch; the Host header validation is automatic. Test that remote monitoring or API clients continue to function after the upgrade to confirm compatibility.

Detection guidance

Monitor for suspicious XML-RPC requests to the Glances server, particularly those with Host headers that do not match the expected server hostname or IP. Check Glances server logs for unusual patterns in method calls or unusually high request frequency. Organizations without logging can enable verbose server logging temporarily (consult Glances documentation) to baseline normal traffic. Network-level detection is difficult without deep packet inspection, but DNS rebinding mitigation at the network edge (e.g., blocking DNS responses that resolve to RFC 1918 private addresses from external sources) provides defense-in-depth.

Why prioritize this

This vulnerability merits prompt but not critical attention. The Medium severity rating reflects the combination of meaningful data exposure (system configuration and performance metrics) against the practical barriers to exploitation (DNS rebinding complexity and user interaction). Prioritize patching for Glances deployments in server mode that are accessible from networks where monitored system users browse untrusted content. Standard deployments using Glances interactively on a single machine face negligible risk.

Risk score, explained

CVSS 3.1 score of 5.3 (Medium) is derived from: Attack Vector = Network (AV:N, remotely triggerable), Attack Complexity = High (AC:H, requires DNS rebinding and timing), Privileges Required = None (PR:N), User Interaction = Required (UI:R, victim must visit attacker site), Scope = Unchanged (S:U), Confidentiality = High (C:H, full system data exfiltration), Integrity = None (I:N), Availability = None (A:N). The high confidentiality impact is offset by the attack complexity and user interaction requirement.

Frequently asked questions