CVE-2026-46611

{
  "id": "CVE-2026-46611",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T19:16:37.800",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5."
    },
    {
      "lang": "es",
      "value": "Glances es una herramienta de monitoreo de sistema multiplataforma de código abierto. Antes de la versión 4.5.5, el servidor XML-RPC de Glances (glances -s, implementado en glances/server.py) no valida la cabecera HTTP Host, dejándolo vulnerable a ataques de reencuadernación de DNS. Un atacante puede explotar la reencuadernación de DNS para exfiltrar el conjunto completo de datos de monitoreo del sistema desde el navegador de una víctima. Esta vulnerabilidad está corregida en la versión 4.5.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nicolargo",
          "product": "glances",
          "versions": [
            {
              "version": "< 4.5.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T02:14:18.408132Z",
          "id": "CVE-2026-46611",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-350"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}