CVE-2026-32632 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
MediumCVSS 5.9
EPSS 0.22%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent host allowlist. As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin. This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target. Version 4.5.2 contains a patch for the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi glances(PyPI) | < 4.5.2 | 4.5.2 |
| pypi glances(PyPI) | = 1.3.1 | No fix listed |
| pypi glances(PyPI) | = 1.3.2 | No fix listed |
| pypi glances(PyPI) | = 1.3.3 | No fix listed |
| pypi glances(PyPI) | = 1.3.4 | No fix listed |
| pypi glances(PyPI) | = 1.3.5 | No fix listed |
| pypi glances(PyPI) | = 1.3.6 | No fix listed |
| pypi glances(PyPI) | = 1.3.7 | No fix listed |
| pypi glances(PyPI) | = 1.4 | No fix listed |
| pypi glances(PyPI) | = 1.4.1 | No fix listed |
| pypi glances(PyPI) | = 1.4.1.1 | No fix listed |
| pypi glances(PyPI) | = 1.4.2 | No fix listed |
| pypi glances(PyPI) | = 1.4.2.1 | No fix listed |
| pypi glances(PyPI) | = 1.5 | No fix listed |
| pypi glances(PyPI) | = 1.5.1 | No fix listed |
| pypi glances(PyPI) | = 1.5.2 | No fix listed |
| pypi glances(PyPI) | = 1.6 | No fix listed |
| pypi glances(PyPI) | = 1.6.1 | No fix listed |
| pypi glances(PyPI) | = 1.7 | No fix listed |
| pypi glances(PyPI) | = 1.7.1 | No fix listed |
| pypi glances(PyPI) | = 1.7.2 | No fix listed |
| pypi glances(PyPI) | = 1.7.3 | No fix listed |
| pypi glances(PyPI) | = 1.7.4 | No fix listed |
| pypi glances(PyPI) | = 1.7.5 | No fix listed |
| pypi glances(PyPI) | = 1.7.6 | No fix listed |
Show 141 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi glances(PyPI) | = 1.7.7 | No fix listed |
| pypi glances(PyPI) | = 2.0 | No fix listed |
| pypi glances(PyPI) | = 2.0.1 | No fix listed |
| pypi glances(PyPI) | = 2.1 | No fix listed |
| pypi glances(PyPI) | = 2.1.1 | No fix listed |
| pypi glances(PyPI) | = 2.1.2 | No fix listed |
| pypi glances(PyPI) | = 2.10 | No fix listed |
| pypi glances(PyPI) | = 2.11 | No fix listed |
| pypi glances(PyPI) | = 2.11.1 | No fix listed |
| pypi glances(PyPI) | = 2.2 | No fix listed |
| pypi glances(PyPI) | = 2.2.1 | No fix listed |
| pypi glances(PyPI) | = 2.3 | No fix listed |
| pypi glances(PyPI) | = 2.4 | No fix listed |
| pypi glances(PyPI) | = 2.4.1 | No fix listed |
| pypi glances(PyPI) | = 2.4.2 | No fix listed |
| pypi glances(PyPI) | = 2.5 | No fix listed |
| pypi glances(PyPI) | = 2.5.1 | No fix listed |
| pypi glances(PyPI) | = 2.6 | No fix listed |
| pypi glances(PyPI) | = 2.6.1 | No fix listed |
| pypi glances(PyPI) | = 2.6.2 | No fix listed |
| pypi glances(PyPI) | = 2.7 | No fix listed |
| pypi glances(PyPI) | = 2.7.1 | No fix listed |
| pypi glances(PyPI) | = 2.8 | No fix listed |
| pypi glances(PyPI) | = 2.8.1 | No fix listed |
| pypi glances(PyPI) | = 2.8.2 | No fix listed |
| pypi glances(PyPI) | = 2.8.3 | No fix listed |
| pypi glances(PyPI) | = 2.8.4 | No fix listed |
| pypi glances(PyPI) | = 2.8.5 | No fix listed |
| pypi glances(PyPI) | = 2.8.6 | No fix listed |
| pypi glances(PyPI) | = 2.8.7 | No fix listed |
| pypi glances(PyPI) | = 2.8.8 | No fix listed |
| pypi glances(PyPI) | = 2.9.0 | No fix listed |
| pypi glances(PyPI) | = 2.9.1 | No fix listed |
| pypi glances(PyPI) | = 3.0 | No fix listed |
| pypi glances(PyPI) | = 3.0.1 | No fix listed |
| pypi glances(PyPI) | = 3.0.2 | No fix listed |
| pypi glances(PyPI) | = 3.1.0 | No fix listed |
| pypi glances(PyPI) | = 3.1.1 | No fix listed |
| pypi glances(PyPI) | = 3.1.2 | No fix listed |
| pypi glances(PyPI) | = 3.1.3 | No fix listed |
| pypi glances(PyPI) | = 3.1.4 | No fix listed |
| pypi glances(PyPI) | = 3.1.4.1 | No fix listed |
| pypi glances(PyPI) | = 3.1.5 | No fix listed |
| pypi glances(PyPI) | = 3.1.6 | No fix listed |
| pypi glances(PyPI) | = 3.1.6.1 | No fix listed |
| pypi glances(PyPI) | = 3.1.6.2 | No fix listed |
| pypi glances(PyPI) | = 3.1.7 | No fix listed |
| pypi glances(PyPI) | = 3.2.0 | No fix listed |
| pypi glances(PyPI) | = 3.2.1 | No fix listed |
| pypi glances(PyPI) | = 3.2.2 | No fix listed |
| pypi glances(PyPI) | = 3.2.3 | No fix listed |
| pypi glances(PyPI) | = 3.2.3.1 | No fix listed |
| pypi glances(PyPI) | = 3.2.4 | No fix listed |
| pypi glances(PyPI) | = 3.2.4.1 | No fix listed |
| pypi glances(PyPI) | = 3.2.4.2 | No fix listed |
| pypi glances(PyPI) | = 3.2.5 | No fix listed |
| pypi glances(PyPI) | = 3.2.6.1 | No fix listed |
| pypi glances(PyPI) | = 3.2.6.2 | No fix listed |
| pypi glances(PyPI) | = 3.2.6.3 | No fix listed |
| pypi glances(PyPI) | = 3.2.6.4 | No fix listed |
| pypi glances(PyPI) | = 3.2.7 | No fix listed |
| pypi glances(PyPI) | = 3.3.0 | No fix listed |
| pypi glances(PyPI) | = 3.3.0.1 | No fix listed |
| pypi glances(PyPI) | = 3.3.0.2 | No fix listed |
| pypi glances(PyPI) | = 3.3.0.3 | No fix listed |
| pypi glances(PyPI) | = 3.3.0.4 | No fix listed |
| pypi glances(PyPI) | = 3.3.1 | No fix listed |
| pypi glances(PyPI) | = 3.3.1.1 | No fix listed |
| pypi glances(PyPI) | = 3.4.0 | No fix listed |
| pypi glances(PyPI) | = 3.4.0.1 | No fix listed |
| pypi glances(PyPI) | = 3.4.0.2 | No fix listed |
| pypi glances(PyPI) | = 3.4.0.3 | No fix listed |
| pypi glances(PyPI) | = 3.4.0.4 | No fix listed |
| pypi glances(PyPI) | = 3.4.0.5 | No fix listed |
| pypi glances(PyPI) | = 4.0.1 | No fix listed |
| pypi glances(PyPI) | = 4.0.2 | No fix listed |
| pypi glances(PyPI) | = 4.0.3 | No fix listed |
| pypi glances(PyPI) | = 4.0.4 | No fix listed |
| pypi glances(PyPI) | = 4.0.5 | No fix listed |
| pypi glances(PyPI) | = 4.0.6 | No fix listed |
| pypi glances(PyPI) | = 4.0.7 | No fix listed |
| pypi glances(PyPI) | = 4.0.8 | No fix listed |
| pypi glances(PyPI) | = 4.1.0 | No fix listed |
| pypi glances(PyPI) | = 4.1.1 | No fix listed |
| pypi glances(PyPI) | = 4.1.2 | No fix listed |
| pypi glances(PyPI) | = 4.2.0 | No fix listed |
| pypi glances(PyPI) | = 4.2.1 | No fix listed |
| pypi glances(PyPI) | = 4.3.0 | No fix listed |
| pypi glances(PyPI) | = 4.3.0.1 | No fix listed |
| pypi glances(PyPI) | = 4.3.0.3 | No fix listed |
| pypi glances(PyPI) | = 4.3.0.4 | No fix listed |
| pypi glances(PyPI) | = 4.3.0.5 | No fix listed |
| pypi glances(PyPI) | = 4.3.0.6 | No fix listed |
| pypi glances(PyPI) | = 4.3.0.7 | No fix listed |
| pypi glances(PyPI) | = 4.3.0.8 | No fix listed |
| pypi glances(PyPI) | = 4.3.1 | No fix listed |
| pypi glances(PyPI) | = 4.3.2 | No fix listed |
| pypi glances(PyPI) | = 4.3.3 | No fix listed |
| pypi glances(PyPI) | = 4.4.0 | No fix listed |
| pypi glances(PyPI) | = 4.4.1 | No fix listed |
| pypi glances(PyPI) | = 4.5.0 | No fix listed |
| pypi glances(PyPI) | = 4.5.0.1 | No fix listed |
| pypi glances(PyPI) | = 4.5.0.2 | No fix listed |
| pypi glances(PyPI) | = 4.5.0.3 | No fix listed |
| pypi glances(PyPI) | = 4.5.0.4 | No fix listed |
| pypi glances(PyPI) | = 4.5.0.5 | No fix listed |
| pypi glances(PyPI) | = 4.5.1 | No fix listed |
| nicolargo glances | = < 4.5.2 | No fix listed |
| debian/glances(Debian:12) | All versions | No fix listed |
| debian/glances(Debian:12) | = 3.3.1.1+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 3.4.0.3+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.0.5+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.1.2.1+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.2.1+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.3.0.8+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.3.1+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.3.3+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.5.1+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.5.2+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.5.3.2+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.5.4+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.5.5+dfsg-1 | No fix listed |
| debian/glances(Debian:12) | = 4.5.6+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | All versions | No fix listed |
| debian/glances(Debian:13) | = 4.3.1+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | = 4.3.3+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | = 4.5.1+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | = 4.5.2+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | = 4.5.3.2+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | = 4.5.4+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | = 4.5.5+dfsg-1 | No fix listed |
| debian/glances(Debian:13) | = 4.5.6+dfsg-1 | No fix listed |
| debian/glances(Debian:14) | < 4.5.2+dfsg-1 | 4.5.2+dfsg-1 |
| debian/glances(Debian:14) | = 4.3.1+dfsg-1 | No fix listed |
| debian/glances(Debian:14) | = 4.3.3+dfsg-1 | No fix listed |
| debian/glances(Debian:14) | = 4.5.1+dfsg-1 | No fix listed |
| ubuntu/glances(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/glances(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/glances(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/glances(Ubuntu:26.10) | All versions | No fix listed |
| nicolargo glances | < 4.5.2 | 4.5.2 |
References
- https://github.com/nicolargo/glances/security/advisories/GHSA-hhcg-r27j-fhv9 exploit vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- https://github.com/nicolargo/glances/commit/5850c564ee10804fdf884823b9c210eb954dd1f9 patch
- github.com product
- https://github.com/nicolargo/glances/releases/tag/v4.5.2 release-notes vendor-advisory
- github.com
- Debian Security Tracker CVE-2026-32632 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org