Glances XML-RPC Missing Host Header Validation Enables DNS Rebinding (CVE-2026-32652)

Vulnerability Overview Vulnerability Name: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack Vulnerability Description: The Glances XML-RPC server ( , implemented in ) does not validate the HTTP Host header, making it susceptible to DNS rebinding attacks. CVE-2026-32652 (patched in version 4.5.2) added to the REST/WebUI server, and the MCP server has had equivalent protection since version 4.5.1. The XML-RPC server did not receive this fix and lacks an configuration key. Combined with the unrestricted header (see associated advisory CVE-2026-32653 and its incomplete remediation), an attacker can exploit DNS rebinding to steal complete system monitoring datasets from the victim's browser. Affected Component: — / Direct URL (commit 8457977): https://github.com/nicolargo/glances/blob/84579778e73d705896a169e0d9dc84772c852da/glances/server.py Comparison - Patched Backends: https://github.com/nicolargo/glances/blob/84579778e73d705896a169e0d9dc84772c852da/glances/outputs/glances_restful_api.py https://github.com/nicolargo/glances/blob/84579778e73d705896a169e0d9dc84772c852da/glances/outputs/glances_mcp.py The class inherits from Python's and does not override to check or validate the Host header. In contrast, the other two Glances server backends implement host validation hardening: REST / WebUI Server ( ) — Patched in 4.5.2: MCP Server ( ) — Protected since 4.5.1: XML-RPC Server ( ) — No equivalent exists: There is no (or equivalent) configuration key in ; the server ignores the Host header in every incoming request. Confirmed on: x86_64 Linux, Python 3.12, Glances 4.5.5_dev1 (commit 8457977) Test Results: Impact Scope Vulnerability Type: Insufficient Data Authenticity Verification / DNS Rebinding (CWE-350) Affected Users: Any user whose browser can access the Glances XML-RPC server and is tricked into visiting a webpage controlled by the attacker. This includes the following deployments: Glances bound to 127.0.0.1 (loopback) — DNS rebinding bypasses loopback restrictions. Glances bound to LAN IP — Any browser on that LAN is at risk. Glances exposed on a public IP — Any user on a browser is at risk. Data Exposed via XML-RPC API: Hostname, OS and kernel version, full process list with command-line arguments (frequently containing API keys, database passwords, access tokens as environment variables or CLI flags), CPU/memory/disk/network statistics, open file descriptors, listening ports, Docker/Kubernetes container metadata. Impact: Confidentiality: High — Full system monitoring data can be read remotely without credentials. Integrity: None — Read-only access to the XML-RPC API. Availability: None — No denial-of-service to service components. The attack is amplified by the wildcard CORS header (vuln03) from the companion advisory: without , the browser would still block the response from being read. Both issues must be fixed together to achieve effective remediation. Remediation Recommended Fixes: Option 1 — Add Host Validation to XML-RPC Processor (Preferred) Add a (or new ) configuration key and validate the Host header in : Populate from the existing configuration key (which the REST server already uses), giving operators a single knob to manage. Option 2 — Deprecate and Remove XML-RPC Server The XML-RPC server is a legacy interface. The REST API ( ) provides a superset of functionality, is actively maintained, and includes all current security controls. Deprecating the XML-RPC server and guiding users to the REST API in the next major version will completely eliminate this attack surface. POC Code Step 1 — Start Glances XML-RPC Server Step 2 — Confirm Server Accepts Any Host Header Expected Result (Secure): HTTP/1.0 400 Bad Request Actual Result: HTTP/1.0 200 OK with full XML-RPC response body. Step 3 — Confirm REST API is Patched (Comparison) Step 4 — Full DNS Rebinding Exploitation (Real-World Path) 1. The attacker registers with a low TTL (1 second). The DNS record initially points to their own server IP. 2. The attacker serves the following page from : 3. The victim visits in their browser. 4. After the TTL expires, the attacker's DNS server responds with . 5. The browser's call is sent to with — the XML-RPC server accepts it. 6. The header (see companion advisory) allows the browser to read the response body. 7. The attacker receives a complete snapshot of the system monitoring data. Simplified DNS Rebinding Tools: Squidity dns rebinder Step 5 — Confirm Missing Host Check in Source Code

Goal Reached Thanks to every supporter — we hit 100%!

Glances XML-RPC Missing Host Header Validation Enables DNS Rebinding (CVE-2026-32652)

More from this source