CVE-2026-46611

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.5

Description The XML-RPC server (implemented in glances/server.py and started with glances -s) fails to validate the HTTP Host header. This allows a DNS rebinding attack, where an attacker can bypass the same-origin policy to exfiltrate the complete system monitoring dataset through a victim's browser. DNS rebinding is a technique used to trick a browser into making requests to a local or private network resource by manipulating DNS records.

Recommendations Update to version 4.5.5.