CVE-2026-44184 Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads
Attackers can steal admin API keys via cross-origin requests if trusted network authentication is enabled, allowing full control over the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-44184?
CVE-2026-44184 is a high-severity vulnerability in Cleanuparr, published on 12 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthenticationHandler. The combination lets any website that an admin (or any user on a trusted IP) visits read authenticated API responses cross-origin — including the admin's permanent API key. This vulnerability is fixed in 2.9.10.
Which versions are affected by CVE-2026-44184?
How do I fix CVE-2026-44184?
No fix has been published for CVE-2026-44184 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-44184 being exploited?
There is no known exploitation of CVE-2026-44184 in the wild and no public exploit code.
Sources
Also known as GHSA-rwpc-36mg-fpvf.