Authentication bypass via X-Forwarded-For spoofing in Cleanuparr (CVE-2026-44183)

TrustedNetworkAuthenticationHandler.ResolveClientIp trusts the leftmost entry of the X-Forwarded-For header as the client IP, but that value is attacker-controlled since X-Forwarded-For is append-only. An unauthenticated remote attacker can spoof a local IP in this header to pass the trusted-network check and gain full administrative access to the Cleanuparr instance, including exfiltration of stored API keys and credentials. Affected versions: - <= 2.9.9 We recommend updating to: 2.9.10. CVSS 9.8 · our assessment: act_now Reference: https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-8q44-v65j-jc3q Details: https://vuln.today/cve/CVE-2026-44183