Medium [CVE-2026-46611] Information disclosure via DNS rebinding attack
This medium-severity Red Hat Linux advisory covers CVE-2026-46611.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks.
An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.
If a user is tricked into visiting a malicious website, a remote attacker can exploit this flaw to exfiltrate sensitive system monitoring data. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
Weakness: CWE-346.
- < 4.5.5
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation checklist
- The XML-RPC server is a legacy interface started via the -s or --server flags. To maintain remote monitoring functionality securely, operators should migrate to the actively maintained REST API by starting Glances with the -w or --webserver flag instead. The REST API component is protected against DNS rebinding attacks.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.