Glances’ REST/WGiven WebUI does not validate the Host header, which enables DNS rebinding attacks. An attacker can point a domain they control to the Glances service, causing victims’ browsers to treat that domain as same‑origin. Because the API, WebUI, and token endpoint are reachable in this manner, an attacker can send arbitrary requests to the Glances API from a victim’s browser, potentially exposing sensitive system information or triggering unintended actions. This flaw is classified as CWE‑346, an information exposure due to insecure host validation.

The issue impacts nicolargo:glances releases prior to version 4.5.2. Any deployment of Glances 4.5.1 or earlier that exposes the REST/WebUI on a network reachable by users is vulnerable.

The CVSS score of 5.9 reflects a moderate vulnerability. An EPSS score of less than 1% indicates that, as of now, the likelihood of active exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is client‑side (browser‑based) and requires the attacker to control a DNS name that can be rebound to the target. An attacker who can successfully bind a malicious domain to the Glances service can bypass same‑origin policy and gain unauthorized API access, potentially compromising confidentiality and integrity of monitored data.