Glance CVE-2026-63770

The Glance server must be running with the Server.Proxied option enabled (a non-default deployment mode intended for reverse-proxy setups); this is the concrete AT:P attack requirement. Under that condition the authentication handler reads the client-controlled leftmost X-Forwarded-For value as the source identity for its per-IP failed-login counter, so an unauthenticated remote attacker simply supplies a different arbitrary XFF leftmost value on each request to evade the lockout threshold. Limiting factors: if 'proxied' is disabled the app uses RemoteAddr and is not exploitable; and even with the bypass, gaining access still requires guessing valid credentials, so strong/unique passwords materially reduce real-world impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H) scores 8.2 (High): network-reachable, low complexity, no privileges or user interaction, but with AT:P signalling a genuine attack requirement - the non-default 'proxied' option must be enabled. This AT:P condition is the single most important tempering factor: default Glance installations that do not sit behind a configured trusted proxy are not affected. There is no EPSS score, KEV listing, or POC provided, so this is not evidence of active or widespread exploitation; the risk is driven by ease of technique rather than observed attacks. The VC:H rating is somewhat optimistic in that the header spoof itself only removes rate limiting - actual confidentiality loss still depends on weak or guessable credentials - so treat this as an enabler that amplifies credential-guessing risk rather than a direct data-disclosure bug. Net: a real, easily-weaponized weakness for proxied deployments with weak passwords, but lower priority for default (non-proxied) installs.

An attacker locates a Glance instance running in proxied mode and repeatedly POSTs login guesses to the authentication endpoint, incrementing the leftmost X-Forwarded-For value (e.g. 1.1.1.1, 1.1.1.2, ...) on each request. Each attempt registers as a distinct source IP, so the per-IP lockout never fires and the attacker can run an unbounded dictionary or credential-stuffing attack until a valid password is found. No POC was published, but the fix diff and advisory make the header-rotation technique straightforward to reproduce.