CVE-2026-32632

CVE-2026-32632 identifies a DNS rebinding vulnerability in nicolargo Glances versions prior to 4.5.2, where the main REST/WebUI FastAPI application accepts arbitrary Host headers. This flaw allows an attacker to bypass same-origin policy protections, enabling unauthorized access to the Glances API, WebUI, and token endpoint through a victim's browser. Rated as a Medium severity (CVSS 5.9), exploitation requires high attack complexity and user interaction, potentially leading to high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code, or significant community attention, with a very low EPSS score indicating a low probability of exploitation.