CVE-2026-44184

Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads

State: Published
Severity: 8.0 High
Published: May 12, 2026
Updated: May 12, 2026
Reserved: May 5, 2026

Description

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthenticationHandler. The combination lets any website that an admin (or any user on a trusted IP) visits read authenticated API responses cross-origin — including the admin's permanent API key. This vulnerability is fixed in 2.9.10.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-346 Origin Validation Error
CWE-942 Permissive Cross-domain Policy with Untrusted Domains

Affected Products

Product	Versions
CleanuparrCleanuparr	< 2.9.10Affected

References

https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-rwpc-36mg-fpvf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.