The Glances XML‑RPC server, before version 4.5.5, fails to validate the HTTP Host header, exposing the system monitoring dataset to an adversary. By exploiting DNS rebinding, an attacker can cause a victim’s browser to query the local XML‑RPC endpoint and exfiltrate all monitoring data. The weakness is a form of improper input validation (CWE‑346) and an access control problem (CWE‑350) that permits unauthorized information disclosure.

The vulnerability affects the Glances monitoring tool developed by nicolargo, specifically all releases earlier than 4.5.5. Versions 4.5.4 and below run the XML‑RPC server without host header checks and are susceptible to the described attack.

The CVSS score of 5.3 indicates moderate severity, with no EPSS score available and the vulnerability not yet listed in CISA KEV. Based on the description, it is inferred that the attack vector requires a victim’s browser to interact with a malicious web page that performs DNS rebinding against the local XML‑RPC endpoint. Exploitation is therefore limited to environments where the endpoint is reachable from a browser and relies on user interaction; however, once triggered, the attacker can read the entire monitoring dataset.