CVE-2026-46611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46611", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T19:34:14.011Z", "datePublished": "2026-06-25T18:00:47.735Z", "dateUpdated": "2026-06-26T02:14:42.354Z"}, "containers": {"cna": {"title": "Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-350", "lang": "en", "description": "CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338"}, {"name": "https://github.com/nicolargo/glances/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"}], "affected": [{"vendor": "nicolargo", "product": "glances", "versions": [{"version": "< 4.5.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-25T18:00:47.735Z"}, "descriptions": [{"lang": "en", "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5."}], "source": {"advisory": "GHSA-w856-8p3r-p338", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T02:14:18.408132Z", "id": "CVE-2026-46611", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T02:14:42.354Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46611", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T02:14:18.408132Z"}}}], "references": [{"url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T02:14:35.954Z"}}], "cna": {"title": "Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack", "source": {"advisory": "GHSA-w856-8p3r-p338", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nicolargo", "product": "glances", "versions": [{"status": "affected", "version": "< 4.5.5"}]}], "references": [{"url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "name": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5", "name": "https://github.com/nicolargo/glances/releases/tag/v4.5.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-350", "description": "CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-25T18:00:47.735Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46611", "state": "PUBLISHED", "dateUpdated": "2026-06-26T02:14:42.354Z", "dateReserved": "2026-05-15T19:34:14.011Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-25T18:00:47.735Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "glances", "vendor": "nicolargo", "versions": [{"status": "affected", "version": "< 4.5.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5."}, {"lang": "es", "value": "Glances es una herramienta de monitoreo de sistema multiplataforma de c\u00f3digo abierto. Antes de la versi\u00f3n 4.5.5, el servidor XML-RPC de Glances (glances -s, implementado en glances/server.py) no valida la cabecera HTTP Host, dej\u00e1ndolo vulnerable a ataques de reencuadernaci\u00f3n de DNS. Un atacante puede explotar la reencuadernaci\u00f3n de DNS para exfiltrar el conjunto completo de datos de monitoreo del sistema desde el navegador de una v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.5.5."}], "id": "CVE-2026-46611", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46611", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T02:14:18.408132Z", "version": "2.0.3"}}]}, "published": "2026-06-25T19:16:37.800", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-350"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "glances: Glances: Information disclosure via DNS rebinding attack", "id": "2493117", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493117"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["A vulnerability in the Glances XML-RPC server fails to properly validate HTTP Host headers, enabling DNS rebinding attacks. If a user is tricked into visiting a malicious website, a remote attacker can exploit this flaw to exfiltrate sensitive system monitoring data."], "mitigation": {"lang": "en:us", "value": "The XML-RPC server is a legacy interface started via the -s or --server flags. To maintain remote monitoring functionality securely, operators should migrate to the actively maintained REST API by starting Glances with the -w or --webserver flag instead. The REST API component is protected against DNS rebinding attacks."}, "name": "CVE-2026-46611", "public_date": "2026-06-25T18:00:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46611\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46611\nhttps://github.com/nicolargo/glances/releases/tag/v4.5.5\nhttps://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338"], "statement": "This moderate DNS rebinding vulnerability in the Glances XML-RPC server allows for information disclosure. An attacker can exfiltrate system monitoring data, provided they trick a user into visiting a malicious site.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.5.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "glances", "source": "cna", "vendor": "nicolargo"}, "product": "glances", "vendor": "nicolargo"}], "created": "2026-06-25T19:30:15.940366+00:00", "updated": "2026-06-25T21:15:05.051622+00:00", "vendors": ["nicolargo", "nicolargo$PRODUCT$glances"]}