CVE-2026-46611

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nicolargo/glances/releases/tag/v4.5.5
https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338
https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338

Configurations

No configuration.

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Glances es una herramienta de monitoreo de sistema multiplataforma de código abierto. Antes de la versión 4.5.5, el servidor XML-RPC de Glances (glances -s, implementado en glances/server.py) no valida la cabecera HTTP Host, dejándolo vulnerable a ataques de reencuadernación de DNS. Un atacante puede explotar la reencuadernación de DNS para exfiltrar el conjunto completo de datos de monitoreo del sistema desde el navegador de una víctima. Esta vulnerabilidad está corregida en la versión 4.5.5.

Information

Published : 2026-06-25 19:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-46611

Mitre link : CVE-2026-46611

CVE.ORG link : CVE-2026-46611

JSON object : View

Products Affected

No product.

CWE

CWE-346

Origin Validation Error

CWE-350

Reliance on Reverse DNS Resolution for a Security-Critical Action

{"id": "CVE-2026-46611", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46611", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T02:14:18.408132Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nicolargo", "product": "glances", "versions": [{"status": "affected", "version": "< 4.5.5"}]}]}], "published": "2026-06-25T19:16:37.800", "references": [{"url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "source": "security-advisories@github.com"}, {"url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-350"}]}], "descriptions": [{"lang": "en", "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5."}, {"lang": "es", "value": "Glances es una herramienta de monitoreo de sistema multiplataforma de c\u00f3digo abierto. Antes de la versi\u00f3n 4.5.5, el servidor XML-RPC de Glances (glances -s, implementado en glances/server.py) no valida la cabecera HTTP Host, dej\u00e1ndolo vulnerable a ataques de reencuadernaci\u00f3n de DNS. Un atacante puede explotar la reencuadernaci\u00f3n de DNS para exfiltrar el conjunto completo de datos de monitoreo del sistema desde el navegador de una v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.5.5."}], "lastModified": "2026-10-25T22:10:00.150", "sourceIdentifier": "security-advisories@github.com"}