CVE-2026-44183
Critical · 9.8CVSS
9.8
EPSS
0.3%
Published
May 12, 2026
CISA due date
—
The record
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the X-Forwarded-For header as the client IP. That entry is attacker-controlled — X-Forwarded-For is append-only, so the leftmost value is whatever the original HTTP client claimed. By sending a spoofed local IP in the header, an unauthenticated remote attacker passes the trusted-network check and is logged in as the Cleanuparr administrator. This vulnerability is fixed in 2.9.10.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
- CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
- CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
- CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290
- CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control… CWE-290
- CVE-2026-77089 Command Center API contained an authentication bypass issue affecting privilege… CWE-290
- CVE-2026-86478 In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in… CWE-290
- CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function… CWE-290