CVE-2026-46611
Summary
The Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. CVE-2026-32632 (patched in 4.5.2) added TrustedHostMiddleware to the REST/WebUI server; the MCP server has had equivalent protection since 4.5.1. The XML-RPC server received neither fix and has no allowed-hosts configuration key. Combined with the unrestricted Access-Control-Allow-Origin: * header (see companion advisory for CVE-2026-33533 and its incomplete fix), an attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser.
Details
Affected component: glances/server.py — GlancesXMLRPCHandler / GlancesXMLRPCServer
Direct URL (commit 04579778e733d705898a169e049dc84772c852da):
- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/server.py
Contrast — patched backends:
- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/outputs/glances_restful_api.py
- https://github.com/nicolargo/glances/blob/04579778e733d705898a169e049dc84772c852da/glances/outputs/glances_mcp.py
The GlancesXMLRPCHandler class inherits from Python's xmlrpc.server.SimpleXMLRPCRequestHandler and does not override parse_request() to inspect or validate the Host header.
Contrast this with the two other Glances server backends, both of which received host-validation hardening:
REST / WebUI server (glances/outputs/glances_restful_api.py) — patched in 4.5.2:
glances_restful_api.py
if self.webui_allowed_hosts:
self._app.add_middleware(
TrustedHostMiddleware,
allowed_hosts=self.webui_allowed_hosts,
)
MCP server (glances/outputs/glances_mcp.py) — protected since 4.5.1:
glances_mcp.py
TransportSecuritySettings(
allowed_hosts=self.mcp_allowed_hosts,
...
)
XML-RPC server (glances/server.py) — no equivalent exists:
class GlancesXMLRPCHandler(SimpleXMLRPCRequestHandler, GlancesAPI):
No Host header check; an
⚡ Watch CVE-2026-46611
Get an email if CVE-2026-46611 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-46611)