CVE-2026-32632 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
Attackers can bypass same-origin policy via DNS rebinding to access Glances REST API and WebUI, allowing unauthorized data access or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32632?
CVE-2026-32632 is a medium-severity vulnerability in nicolargo glances, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Glances is an open-source system cross-platform monitoring tool. Glances recently added DNS rebinding protection for the MCP endpoint, but prior to version 4.5.2, the main REST/WebUI FastAPI application still accepts arbitrary `Host` headers and does not apply `TrustedHostMiddleware` or an equivalent host allowlist. As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin. This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target. Version 4.5.2 contains a patch for the issue.
Weakness: CWE-346
Which versions are affected by CVE-2026-32632?
3 open source packages ship an affected version, including glances and Glances. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
glances PyPI | All versions | 4.5.2 |
glances PyPI | All versions | 4.5.2 |
Glances PyPI | All versions | 4.5.2 |
Products include Nicolargo Glances.
How do I fix CVE-2026-32632?
Upgrade glances to 4.5.2 or later.
Is CVE-2026-32632 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32632 exists.
Other vulnerabilities in nicolargo glances
- CVE-2026-32633 Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
- CVE-2026-32596 Glances exposes the REST API without authentication
- CVE-2026-30928 Glances Exposes Unauthenticated Configuration Secrets
- CVE-2026-32610 Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
- CVE-2026-32634 Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
Sources
Also known as DEBIAN-CVE-2026-32632, GHSA-hhcg-r27j-fhv9, PYSEC-2026-2171, UBUNTU-CVE-2026-32632.