CVE-2026-26069 Details
Description
Scraparr is a Prometheus Exporter for various components of the *arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions are met, Readarr scraping feature was enabled and no alias configured, the exporter’s /metrics endpoint was accessible to external or unauthorized users, and the Readarr instance is externally accessible. If the /metrics endpoint was publicly accessible, the Readarr API key could have been disclosed via exported metrics data. This vulnerability is fixed in 3.0.2.
A vulnerability in Scraparr, a Prometheus exporter for the *arr Suite, allows for the exposure of Readarr API keys in metric labels. This issue affects versions 3.0.0-beta prior to 3.0.2. The vulnerability arises when the Readarr integration is enabled without a custom alias, the exporter's /metrics endpoint is accessible to external or unauthorized users, and the Readarr instance is externally reachable. Under these conditions, the Readarr API key could be leaked through the exported metrics.
Users should upgrade to Scraparr version 3.0.2 or later, where this vulnerability has been fixed by removing API keys from metric label values. If an immediate upgrade is not possible, users should restrict external access to their Readarr instance and protect the /metrics endpoint with authentication or bind it to localhost.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thecfu/scraparr/commit/194116bb8fb0b6ea26421b3e7a7b326973f56cd0 | [email protected] | Patch |
| https://github.com/thecfu/scraparr/releases/tag/v3.0.2 | [email protected] | ProductRelease Notes |
| https://github.com/thecfu/scraparr/security/advisories/GHSA-hx24-222f-w5cj | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thecfu scraparr | >= 3.0.0, < 3.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 23, 2026 | Initial Analysis | [email protected] |
| Feb 12, 2026 | New CVE Received | [email protected] |