Glances XML-RPC Server Missing Host Header Validation

The Glances XML-RPC server (glances -s) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. The REST/WebUI and MCP servers have been patched with Host validation, but the XML-RPC server has not.

Any user whose browser can reach a Glances XML-RPC server and who can be lured to visit an attacker-controlled web page. This includes deployments bound to loopback, LAN, or public IP.

Apply the suggested fix by adding Host header validation to GlancesXMLRPCHandler or deprecate the XML-RPC server in favor of the REST API.