CVE-2026-63770: Glance Auth Bypass Vulnerability

CVE-2026-63770 Overview

CVE-2026-63770 is an IP address spoofing vulnerability in Glance versions through 0.8.5. The flaw resides in the authentication handler and allows unauthenticated attackers to bypass brute-force lockout protections. When the server.proxied option is enabled, Glance trusts the leftmost value of the X-Forwarded-For HTTP header as the client IP address. Attackers can supply arbitrary header values to make each failed login appear to originate from a distinct source address. This prevents the per-IP failed-login counter from reaching the lockout threshold, enabling unlimited credential guessing against the authentication endpoint. The issue is classified under CWE-348: Use of Less Trusted Source.

Critical Impact
Unauthenticated attackers can perform unlimited credential guessing against Glance authentication, defeating brute-force lockout controls when the server is deployed behind a reverse proxy.

Affected Products

Glance dashboard application through version 0.8.5
Deployments with the server.proxied configuration option enabled
Instances placed behind reverse proxies or load balancers that forward X-Forwarded-For headers

Discovery Timeline

2026-07-20 - CVE-2026-63770 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63770

Vulnerability Analysis

Glance implements per-IP brute-force protection by tracking failed authentication attempts and locking accounts after a threshold is reached. When the server.proxied option is enabled, the application reads the client IP address from the X-Forwarded-For request header instead of the transport-layer source address. The handler uses the leftmost value in that header as the trusted client identifier without validating whether the request originated from a trusted proxy.

An attacker can send authentication requests directly to the application or through the proxy while manipulating the X-Forwarded-For header on every request. Each request appears to come from a different source, so the failed-login counter never reaches the lockout threshold for any single tracked address. The rate-limiting control becomes ineffective, and the authentication endpoint accepts unlimited guessing attempts. Details are available in GitHub Issue #1031 and the VulnCheck Advisory on Glance.

Root Cause

The root cause is improper trust in a client-controlled HTTP header [CWE-348]. Glance parses the leftmost X-Forwarded-For value and treats it as authoritative without verifying that the immediate transport peer is a trusted proxy. Header values from untrusted upstream hops are indistinguishable from values inserted by legitimate proxies.

Attack Vector

Exploitation requires network access to the authentication endpoint and knowledge that the target has server.proxied enabled. An attacker submits repeated POST requests to the login endpoint, rotating the X-Forwarded-For value on each request. Credential dictionaries can be tested at high volume because no lockout is ever triggered. The vulnerability does not require authentication or user interaction.

See the GitHub Pull Request #1033 for the corresponding upstream fix.

Detection Methods for CVE-2026-63770

Indicators of Compromise

High volumes of POST requests to the Glance authentication endpoint originating from a small set of transport-layer source IPs but presenting many distinct X-Forwarded-For values.
Repeated authentication failures against multiple accounts within short time windows without corresponding lockout events in application logs.
X-Forwarded-For header values that contain private, reserved, or obviously randomized address ranges inconsistent with legitimate proxy topology.

Detection Strategies

Correlate transport-layer source IP addresses with the leftmost X-Forwarded-For value and alert on high cardinality mismatches per source.
Deploy application-layer rules on the reverse proxy or web application firewall to count authentication failures per real client IP rather than the header value.
Baseline the expected number of unique upstream client addresses and alert on statistical deviations against the /login route.

Monitoring Recommendations

Enable verbose authentication logging in Glance and forward events to a centralized log platform for correlation.
Track failed authentication rates per URL path and alert when thresholds exceed operational baselines.
Monitor reverse proxy access logs for anomalous X-Forwarded-For patterns, including malformed lists and non-routable addresses.

How to Mitigate CVE-2026-63770

Immediate Actions Required

Upgrade Glance to a version that includes the fix from GitHub Pull Request #1033.
If upgrading is not immediately possible, disable the server.proxied option until the patched release can be deployed.
Restrict network access to the authentication endpoint using firewall rules or reverse proxy access control lists.

Patch Information

The upstream fix is tracked in GitHub Pull Request #1033 and referenced in the VulnCheck Advisory on Glance. Administrators should update to the first Glance release that incorporates this pull request and verify the fix in a staging environment before production rollout.

Workarounds

Configure the reverse proxy to overwrite, rather than append to, the X-Forwarded-For header on inbound requests so downstream applications only see a trusted value.
Enforce authentication rate limiting at the reverse proxy or web application firewall layer, keyed on the real transport-layer source address.
Place the Glance authentication endpoint behind a VPN, mutual TLS, or an identity-aware proxy to remove unauthenticated exposure.

bash

# Example NGINX configuration to overwrite X-Forwarded-For
# and enforce per-source rate limiting on the login endpoint
http {
    limit_req_zone $binary_remote_addr zone=login_zone:10m rate=5r/m;

    server {
        listen 443 ssl;

        location /login {
            limit_req zone=login_zone burst=5 nodelay;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_pass http://glance_backend;
        }
    }
}