CVE-2026-32632
- Source
- https://cve.org/CVERecord?id=CVE-2026-32632
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32632.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-32632
- Aliases
- Downstream
- Related
- Published
- 2026-03-18T17:47:25Z
- Modified
- 2026-10-28T02:30:23Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
- Details
-
Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary
Hostheaders and does not applyTrustedHostMiddlewareor an equivalent host allowlist. As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin. This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target. Version 4.5.2 contains a patch for the issue. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-346" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32632.json" }- References
-
- https://github.com/nicolargo/glances/releases/tag/v4.5.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32632.json
- https://github.com/nicolargo/glances/security/advisories/GHSA-hhcg-r27j-fhv9
- https://nvd.nist.gov/vuln/detail/CVE-2026-32632
- https://github.com/nicolargo/glances/commit/5850c564ee10804fdf884823b9c210eb954dd1f9
Affected packages
Git / github.com/nicolargo/glances
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nicolargo/glances
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "4.5.2" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "5850c564ee10804fdf884823b9c210eb954dd1f9" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v4.5.2", "range": [ { "fixed": "a56a5b78ef931b1d1391c9898bf735a5b4323ec9" } ], "source": "REFERENCES_TAG" } ] }