CVE-2026-44183

Executive Summary

CVE-2026-44183 is a critical authentication bypass vulnerability in Cleanuparr, a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. The vulnerability resides in the TrustedNetworkAuthenticationHandler.ResolveClientIp method, which parses the leftmost entry of the X-Forwarded-For header as the client IP. Since the X-Forwarded-For header is append-only and attacker-controlled, an unauthenticated remote attacker can spoof a local IP (e.g., 127.0.0.1 or a private subnet IP) to bypass the trusted-network check and gain administrative access to the Cleanuparr instance. This allows full control over the application, including the ability to delete or manipulate files in connected services. The vulnerability has a CVSS score of 9.8 (Critical) and is fixed in version 2.9.10. No public exploit code or PoC is available at this time.

Supply Chain & Package Security

Cleanuparr is a .NET application distributed via GitHub releases and potentially through package managers. Users should verify the integrity of downloaded binaries using checksums provided by the vendor. The vulnerability does not directly affect the supply chain of dependencies, but the administrative access gained could be used to tamper with connected services (Sonarr, Radarr, qBittorrent), potentially leading to supply chain attacks on media files or configurations.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex steps are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components beyond Cleanuparr.
• Confidentiality Impact: High (C:H) – An attacker can access all data managed by Cleanuparr.
• Integrity Impact: High (I:H) – An attacker can modify or delete files and configurations.
• Availability Impact: High (A:H) – An attacker can disrupt the service or delete critical files.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to gain full administrative control over Cleanuparr, which can then be used to compromise connected services.

Deep Dive & Mechanics

The vulnerability is rooted in the TrustedNetworkAuthenticationHandler.ResolveClientIp method. This method is responsible for determining the client's IP address when the application is behind a reverse proxy. The intended logic is to trust the X-Forwarded-For header only if it comes from a known proxy. However, the implementation incorrectly parses the leftmost entry of the header as the client IP without validating the source of the header.

How the Attack Works:

1. An attacker sends an HTTP request to the Cleanuparr instance with a spoofed X-Forwarded-For header containing a local IP address (e.g., 127.0.0.1 or 192.168.1.1).
2. The ResolveClientIp method extracts the leftmost IP from the header and uses it as the client IP.
3. The application then checks if this IP is within the trusted network range (e.g., localhost or private subnets).
4. Since the spoofed IP matches the trusted network, the authentication check passes, and the attacker is logged in as the administrator.

Root Cause: The lack of validation of the X-Forwarded-For header source. The application should only trust the header if it is added by a known reverse proxy, not by the client.

Impact: Full administrative access to Cleanuparr, allowing the attacker to:

• View and delete files in Sonarr, Radarr, and download clients.
• Modify application settings.
• Potentially pivot to connected services.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.9.10):

public string ResolveClientIp(HttpRequest request)
{
    var forwardedFor = request.Headers["X-Forwarded-For"].FirstOrDefault();
    if (!string.IsNullOrEmpty(forwardedFor))
    {
        // Vulnerable: Takes the leftmost IP without validation
        return forwardedFor.Split(',')[0].Trim();
    }
    return request.HttpContext.Connection.RemoteIpAddress.ToString();
}

Patched Code (2.9.10):

public string ResolveClientIp(HttpRequest request)
{
    var forwardedFor = request.Headers["X-Forwarded-For"].FirstOrDefault();
    if (!string.IsNullOrEmpty(forwardedFor))
    {
        // Patched: Only trust the header if it comes from a known proxy
        var remoteIp = request.HttpContext.Connection.RemoteIpAddress;
        if (IsTrustedProxy(remoteIp))
        {
            // Take the rightmost IP (the one added by the last trusted proxy)
            return forwardedFor.Split(',').Last().Trim();
        }
    }
    return request.HttpContext.Connection.RemoteIpAddress.ToString();
}

private bool IsTrustedProxy(IPAddress ip)
{
    // Check against a list of known proxy IPs
    return trustedProxies.Contains(ip);
}

Key Difference: The patched code validates the source IP of the request before trusting the X-Forwarded-For header. It also takes the rightmost IP (added by the last trusted proxy) instead of the leftmost (attacker-controlled).

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Cleanuparr instance running version < 2.9.10.
• Network access to the target.

Exploitation Steps:

1. Identify the target Cleanuparr instance (e.g., http://target:8080).
2. Send a request with a spoofed X-Forwarded-For header containing a local IP:

   curl -X GET http://target:8080/api/admin -H "X-Forwarded-For: 127.0.0.1"
   

3. The application will treat the request as coming from a trusted network and grant administrative access.
4. Use the administrative session to perform actions (e.g., delete files, modify settings).

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor for requests with X-Forwarded-For headers containing local IPs (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from external sources.
2. Check logs for authentication events where the client IP is a local address but the request originates from an external IP.
3. Verify that the application is behind a reverse proxy and that the proxy is configured to strip or overwrite the X-Forwarded-For header from clients.

Lab Setup:

• Deploy a vulnerable Cleanuparr instance (version < 2.9.10) in an isolated environment.
• Use a tool like Burp Suite or curl to send spoofed headers.
• Monitor logs and network traffic to observe the attack.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with X-Forwarded-For headers containing private IP addresses (e.g., 127.0.0.1, 10.0.0.1, 192.168.1.1) from external sources.
  • Unusual administrative actions (e.g., file deletions, configuration changes) originating from IPs that should not have administrative access.

• Log IOCs:

  • Authentication logs showing successful login with a client IP that is a private address but the request source IP is external.
  • Access logs showing requests to administrative endpoints (e.g., /api/admin) with spoofed headers.

• File IOCs:

  • Unexpected deletion or modification of files in connected services (Sonarr, Radarr, qBittorrent).

Detection Engineering

YARA Rule

rule CVE_2026_44183_Cleanuparr_XForwardedFor_Spoofing {
    meta:
        description = "Detects attempts to exploit CVE-2026-44183 by spoofing X-Forwarded-For header with local IP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-44183"
    strings:
        $x_forwarded_for = "X-Forwarded-For"
        $local_ip1 = "127.0.0.1"
        $local_ip2 = "10." ascii
        $local_ip3 = "172.16." ascii
        $local_ip4 = "192.168." ascii
    condition:
        $x_forwarded_for and ($local_ip1 or $local_ip2 or $local_ip3 or $local_ip4)
}

Sigma Rule

title: CVE-2026-44183 - Cleanuparr X-Forwarded-For Spoofing
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with spoofed X-Forwarded-For headers containing local IPs targeting Cleanuparr
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44183
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "Cleanuparr"
        cs-headers|contains: "X-Forwarded-For"
        cs-headers|contains|any:
            - "127.0.0.1"
            - "10."
            - "172.16."
            - "192.168."
    condition: selection
falsepositives:
    - Legitimate reverse proxy configurations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-44183 - Cleanuparr X-Forwarded-For Spoofing Attempt"; flow:to_server; content:"X-Forwarded-For"; http_header; pcre:"/X-Forwarded-For\x3a\s*(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Hi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to version 2.9.10 or later – This is the only complete fix.
2. If immediate upgrade is not possible, implement a reverse proxy (e.g., Nginx, Apache) that strips or overwrites the X-Forwarded-For header from client requests.
3. Restrict network access to Cleanuparr to trusted IPs only using firewall rules.

Long-Term Mitigations:

• Ensure that the application is always behind a reverse proxy that validates headers.
• Implement additional authentication mechanisms (e.g., API keys, OAuth) for administrative access.
• Regularly update Cleanuparr and monitor for security advisories.

Workaround:

• Configure the reverse proxy to set the X-Forwarded-For header only from trusted sources and strip any existing header from clients.

Valters IT