CVE-2026-32632 - Vulnerability Analysis

Overview

Glances < 4.5.2 contains a DNS rebinding vulnerability caused by lack of TrustedHostMiddleware in the main REST/WebUI FastAPI application, letting attackers bypass same-origin policy to access API via attacker-controlled domains, exploit requires victim browser to perform DNS rebinding.

Severity & Score

Impact

Attackers can bypass same-origin policy to access REST API and WebUI, potentially leading to unauthorized data access or manipulation.

Mitigation

Update to version 4.5.2 or later.

References

• https://github.com/nicolargo/glances/commit/5850c564ee10804fdf884823b9c210eb954dd1f9
• https://github.com/nicolargo/glances/releases/tag/v4.5.2
• https://github.com/nicolargo/glances/security/advisories/GHSA-hhcg-r27j-fhv9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner