5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46611

CVE-2026-46611: Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46611

CVE-2026-46611:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
glances	pip	< 4.5.5	4.5.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a DNS rebinding attack in the Glances XML-RPC server, caused by a failure to validate the Host header of incoming HTTP requests. The provided information points to glances/server.py as the affected file. By analyzing the commits between the last known good version (4.5.4) and the patched version (4.5.5), I identified commit 5961e0b5077616e672e4f441735ebd162fcd65e7 as the security fix. This commit modifies the GlancesXMLRPCHandler.parse_request method to add the crucial Host header validation. Previously, this function would process requests without checking the Host, making it vulnerable. During an exploit, this function would be on the stack as it processes the malicious request. The GlancesXMLRPCServer.__init__ method was also modified to load the new xmlrpc_allowed_hosts configuration, which is essential for the fix. The lack of this configuration option in the original code is a contributing factor to the vulnerability.

Vulnerable functions

GlancesXMLRPCHandler.parse_request

glances/server.py

The vulnerability lies in the `parse_request` method of the `GlancesXMLRPCHandler` class. Before the patch, this method, which is responsible for parsing incoming XML-RPC requests, did not validate the `Host` header. This omission allowed for DNS rebinding attacks, where an attacker could trick a user's browser into making requests to the Glances server running on localhost or a local network. The server would accept the request with a malicious `Host` header, allowing the attacker's script to access sensitive system information. The patch rectifies this by adding logic to validate the `Host` header against a configurable allowlist before processing the request.

GlancesXMLRPCServer.__init__

glances/server.py

The `__init__` method of the `GlancesXMLRPCServer` class was modified to introduce the `allowed_hosts` configuration. The absence of this configuration and the corresponding validation logic in the server's initialization was a key factor that allowed the DNS rebinding vulnerability to exist. This function is part of the vulnerable code as it lacked the necessary security controls which are added in the patch.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.