Hyperglass pre-auth RCE: ISPs and hosting providers' looking-glass instances exposed to OS command execution
Severity: critical · Patch status: unknown · Since 2026-11-10
A public writeup published 2026-11-10 on oss-sec (research by DS, validated by factoid) describes OS command execution vulnerabilities in hyperglass, a network looking-glass tool, that can be trivially turned into pre-auth remote code execution. Because many ISPs and hosting providers expose their hyperglass instances to the internet, attackers can root these systems directly. The writeup documents hunting and exploitation of vulnerable instances; no CVE, affected versions, or fixed versions are stated in the source, and patch status is unclear. Organisations running internet-facing hyperglass should treat exposure as compromised-risk immediately.
What to do
- Take internet-facing hyperglass instances offline or restrict to trusted management networks immediately
- Assume exposed instances may be rooted; investigate for compromise and rebuild from clean images
- Upgrade to the latest hyperglass release once a patched version is confirmed available
- Place the looking-glass behind a reverse proxy/WAF or access controls that block unauthenticated access to vulnerable endpoints
- Monitor for command-execution indicators and unexpected outbound connections from looking-glass hosts
Sources
All live incidents on Threat Watch
