CVE-2026-32632: Glances REST/WebUI Exposed to DNS Rebinding Due to Lack of Host Validation
Summary
CVE-2026-32632: Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding. Affects glances versions < 4.5.2. Fixed in 4.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Glances is a real-time monitoring tool that provides insights into system performance and resource usage. It offers a web-based interface and REST API for users to access system metrics. However, the application has a vulnerability that allows attackers to exploit DNS rebinding attacks due to insufficient host validation, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability arises from Glances' REST/WebUI FastAPI application, which does not validate the 'Host' headers in incoming requests. This oversight allows attackers to exploit DNS rebinding attacks, where a victim's browser can be tricked into treating an attacker-controlled domain as the same origin as the Glances service. As a result, the attacker can access sensitive API endpoints and potentially read internal data that should be restricted to local or internal networks. The lack of host validation middleware, such as TrustedHostMiddleware, exacerbates this issue, making it easier for attackers to exploit the vulnerability.
How To Fix
Minimum fixed version
4.5.2
This is the first release that contains the fix.
pip install --upgrade "glances==4.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, consider restricting access to the Glances service by binding it to specific IP addresses instead of '0.0.0.0'. For example, you can bind it to '127.0.0.1' to limit access to localhost only.
Conclusion
The vulnerability identified as CVE-2026-32632 in Glances exposes the application to DNS rebinding attacks due to a lack of host validation in its REST/WebUI interface. It is crucial to update to version 4.5.2 or later to mitigate this risk and implement host allowlist enforcement to protect sensitive data.
See every vulnerability recorded for glances →
FAQ
DNS rebinding is an attack technique that allows an attacker to manipulate the DNS resolution of a domain, enabling them to bypass the same-origin policy in web browsers.
You can use Vulert's playground at Vulert Scanner to monitor and alert in real-time for open-source vulnerabilities in your software without requiring access to the code or installation.
The vulnerability can lead to unauthorized access to sensitive data, bypassing of origin-based browser isolation, and exposure of internal REST data that should be protected.
Yes, the CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
If an immediate update is not possible, consider implementing access restrictions by binding the Glances service to specific IP addresses to limit exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for glances.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.