EUVD-2026-29725Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated single-header spoof grants full admin (PR:N/AC:L/AV:N), yielding total confidentiality, integrity, and availability impact within the application scope.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the X-Forwarded-For header as the client IP. That entry is attacker-controlled - X-Forwarded-For is append-only, so the leftmost value is whatever the original HTTP client claimed. By sending a spoofed local IP in the header, an unauthenticated remote attacker passes the trusted-network check and is logged in as the Cleanuparr administrator. This vulnerability is fixed in 2.9.10.
AnalysisAI
Authentication bypass in Cleanuparr before 2.9.10 lets an unauthenticated remote attacker gain full administrator access by spoofing a trusted local IP in the X-Forwarded-For header. Because the TrustedNetworkAuthenticationHandler trusts the leftmost X-Forwarded-For value - which is client-controlled and append-only - any attacker can claim to originate from the trusted network and be logged in as admin. Publicly available exploit code exists (SSVC exploitation: poc) and CISA's SSVC framework rates the attack as automatable with total technical impact, though EPSS remains low at 0.04%.
Technical ContextAI
Cleanuparr is a .NET automation tool that manages cleanup of unwanted or blocked files across the *arr media stack (Sonarr, Radarr) and download clients such as qBittorrent. The flaw resides in its TrustedNetworkAuthenticationHandler.ResolveClientIp routine, which implements IP-based trusted-network authentication by reading the client IP from the X-Forwarded-For (XFF) HTTP header. XFF is an append-only, proxy-populated header; the leftmost entry reflects whatever the original HTTP client claimed and is not authoritative. Correct XFF handling requires parsing from the rightmost trusted proxy inward, or ignoring XFF entirely when no trusted reverse proxy is present. This maps to CWE-290 (Authentication Bypass by Spoofing): the trust decision is based on a spoofable, attacker-supplied value, allowing an adversary to impersonate a trusted-network client.
RemediationAI
Upgrade to Cleanuparr 2.9.10 or later, which contains the fix; this is the primary and definitive remediation (Vendor-released patch: 2.9.10, per GHSA-8q44-v65j-jc3q at https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-8q44-v65j-jc3q). If immediate patching is not possible, do not expose Cleanuparr directly to untrusted networks: place it behind a properly configured reverse proxy that strips or overwrites incoming X-Forwarded-For headers before forwarding (so client-supplied XFF cannot reach the handler), and restrict network access to the Cleanuparr port to trusted management hosts via firewall or VPN. Be aware the XFF-stripping mitigation only works if the proxy is the sole ingress path - any route that reaches Cleanuparr directly bypasses it - and that tightening trusted-network settings may disrupt legitimate reverse-proxy or LAN-based access, so validate proxy IP handling after changes.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today