Glances Project Glances vulnerabilities

CVE-2026-32632 [MEDIUM] CWE-346 Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding ## Summary Glances recently added DNS rebinding protection for the MCP endpoint, but the main REST/WebUI FastAPI application still accepts arbitrary `Host` headers and does not apply `TrustedHostMiddleware` or an equivalent host allowlist. As a result, the REST API, WebUI, and token endpoint remain reach

CVE-2026-68517 [MEDIUM] CWE-942 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard ### Summary Glances's REST API server includes a documented safety check intended to guarantee that `cors_credentials=True` can never be combined with an unrestricted

CVE-2026-68519 [HIGH] CWE-78 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) ## Summary In Glances 4.5.5 the `--disable-config-exec` flag was extended (GHSA-3vwc-qwhc-3mj7) to stop `secure_popen()` from interpreting the shell operators `&&`, `|` and `>` in **AMP** command values taken from the configuration file. The hardening wa

CVE-2026-68520 [MEDIUM] CWE-200 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config ## Summary Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by '********'". However, the implementa

CVE-2026-35588 [MEDIUM] CWE-89 Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values ## Summary The Cassandra export module (`glances/exports/glances_cassandra/__init__.py`) interpolates `keyspace`, `table`, and `replication_factor` configuration values directly into CQL statements without validation. A user with write access to `glances.conf` can redirect all monitoring data

CVE-2026-46611 [MEDIUM] CWE-346 Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack ### Summary The Glances XML-RPC server (`glances -s`, implemented in `glances/server.py`) does not validate the HTTP `Host` header, leaving it vulnerable to DNS rebinding attacks. CVE-2026-32632 (patched in 4.5.2) added `TrustedHostMiddleware` to the REST/WebUI server; the MCP server has had equiv