Scraparr
CVE-2026-26069
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess exposed /metrics endpoint
-
ExploitRetrieve Prometheus metrics
-
ExecutionExtract Readarr API key from alias label
-
ImpactAuthenticate to Readarr instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Readarr integration enabled in Scraparr 3.0.0-beta to 3.0.1 AND no custom alias configured AND /metrics endpoint publicly accessible AND Readarr instance externally reachable |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Scraparr versions 3.0.0-beta through 3.0.1 expose Readarr API keys in plaintext through the /metrics endpoint when the Readarr integration is enabled without a custom alias configured. An attacker with access to the publicly exposed /metrics endpoint can harvest valid API credentials to compromise an externally accessible Readarr instance. This vulnerability affects only deployments where Readarr scraping is enabled, no alias is set, and the metrics endpoint is accessible to untrusted users.
Earlier versions of this analysis (1)
Scraparr is a Prometheus Exporter for various components of the *arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. [CVSS 7.5 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 3.0.2.. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-200 (Information Exposure). Affects Scraparr. Scraparr is a Prometheus Exporter for various components of the *arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions are met, Readarr scraping feature was enabled and no alias configured, the exporter’s /metrics endpoint was accessible to external or unauthorized users, and the Readarr instance is externally accessible.
Know when Scraparr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Scraparr is a Prometheus Exporter for various components of the *arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions are met, Readarr scraping feature was enabled and no alias configured, the exporter’s /metrics endpoint was accessible to external or unauthorized users, and the Readarr instance is externally accessible. If the /metrics endpoint was publicly accessible, the Readarr API key could have been disclosed via exported metrics data. This vulnerability is fixed in 3.0.2.
Executive ViewAI
Scraparr versions 3.0.0-beta through 3.0.1 unintentionally exposed Readarr API credentials in monitoring metrics when the Readarr integration was enabled, creating a credential disclosure vulnerability. Any user or system with access to the Prometheus metrics endpoint could retrieve valid API keys, potentially compromising the security of connected Readarr instances and related systems.
Apply vendor patch. If immediate patching is not possible, disable the Readarr integration in Scraparr until patch can be deployed, restrict network access to Prometheus metrics endpoints to authorized monitoring systems only, and implement RBAC/authentication controls on metric scraping endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB