CVE-2026-44184

High

Published: 12/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2026-44184 affects the Cleanuparr tool, which automates the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients. In versions prior to 2.9.10, the global CORS policy allowed reflecting every request Origin, enabling access to authenticated API responses from other websites.

Risk Assessment

The risk associated with this vulnerability is that any website visited by an admin or a user from a trusted IP could access authenticated API responses, including the admin's permanent API key. This could lead to unauthorized access to sensitive data.

Recommendation

It is recommended to update Cleanuparr to version 2.9.10 or later to mitigate this vulnerability. Additionally, reviewing the CORS policy and authentication mechanisms is advisable to enhance security.

Other vulnerabilities in Cleanuparr

CVE-2026-44183Critical
CVE-2026-44183 affects the Cleanuparr tool, which automates the cleanup of unwanted files in Sonarr, Radarr, and supported download clients. In versions prior to 2.9.10, an attacker could exploit the X-Forwarded-For header to spoof the client IP address, allowing unauthorized access to the administrator account.

Original NVD description (English source)

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthenticationHandler. The combination lets any website that an admin (or any user on a trusted IP) visits read authenticated API responses cross-origin — including the admin's permanent API key. This vulnerability is fixed in 2.9.10.