CVE-2026-44184 Details
Description
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthenticationHandler. The combination lets any website that an admin (or any user on a trusted IP) visits read authenticated API responses cross-origin — including the admin's permanent API key. This vulnerability is fixed in 2.9.10.
A vulnerability in Cleanuparr, a tool for managing unwanted files in Sonarr and Radarr, prior to version 2.9.10, allows for cross-origin reading of authenticated API responses. This issue arises from a global CORS policy that reflects every request origin and combines it with credentials allowance. When 'DisableAuthForLocalAddresses' is enabled, the API authenticates requests based solely on source IP via 'TrustedNetworkAuthenticationHandler'. This combination enables any website visited by an admin, or any user on a trusted IP, to access sensitive API information, including the admin's permanent API key.
Users are advised to update to Cleanuparr version 2.9.10 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-rwpc-36mg-fpvf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-rwpc-36mg-fpvf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cleanuparr | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |