What is the CVSS score of EUVD-2026-29726?

EUVD-2026-29726 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cleanuparr are affected by EUVD-2026-29726?

Cleanuparr versions before 2.9.10 contain a CORS misconfiguration that permits remote theft of administrative API keys when local-network authentication is enabled, potentially granting attackers…. A patch is available.

How to fix or mitigate EUVD-2026-29726?

Within 24 hours, identify all Cleanuparr deployments and verify whether the DisableAuthForLocalAddresses setting is enabled in production; if enabled, treat as critical and proceed immediately to patching. Within 7 days, upgrade all affected Cleanuparr instances to version 2.9.10 or later and restart services to activate the fix. Within 30 days, audit API key access logs for unauthorized activity, rotate all long-lived API keys as a precaution, and implement network segmentation to limit browser-based access to Cleanuparr from untrusted sources.

Cleanuparr EUVD-2026-29726

| CVE-2026-44184 HIGH

Origin Validation Error (CWE-346)

2026-05-12 security-advisories@github.com

Information Disclosure

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Malicious page is web-delivered (AV:N); the required non-default DisableAuthForLocalAddresses config plus trusted-IP victim make AC:H; no attacker auth (PR:N) but victim must visit the page (UI:R); stolen API key yields full C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:08 vuln.today

Patch available

May 12, 2026 - 19:18 EUVD

CVE Published

May 12, 2026 - 18:17 nvd

HIGH 8.0

DescriptionGitHub Advisory

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthenticationHandler. The combination lets any website that an admin (or any user on a trusted IP) visits read authenticated API responses cross-origin - including the admin's permanent API key. This vulnerability is fixed in 2.9.10.

AnalysisAI

Cross-origin API-key theft in Cleanuparr before 2.9.10 lets a malicious website read authenticated API responses-including the admin's permanent API key-because the global CORS policy reflects any request Origin while also setting AllowCredentials. The exposure is unlocked when the DisableAuthForLocalAddresses option is enabled, which authenticates callers purely by source IP, so a browser on a trusted network becomes a confused deputy. No public exploit identified at time of analysis; EPSS is negligible (0.01%) and it is not in CISA KEV, but the technical impact is total account/API compromise.

Technical ContextAI

Cleanuparr is a self-hosted .NET service that automates cleanup of unwanted or blocked downloads across Sonarr, Radarr, and download clients such as qBittorrent. The root cause is CWE-346 (Origin Validation Error): the ASP.NET CORS middleware is configured to echo the incoming Origin header back in Access-Control-Allow-Origin and to send Access-Control-Allow-Credentials: true. Per the Fetch/CORS spec this combination is precisely what allows a third-party page's JavaScript to read credentialed responses. Compounding this, the TrustedNetworkAuthenticationHandler grants API access based solely on the client's source IP when DisableAuthForLocalAddresses is enabled, so a victim's browser sitting on a trusted LAN/loopback range is treated as authenticated even for requests initiated by an attacker-controlled origin.

RemediationAI

Vendor-released patch: upgrade to Cleanuparr 2.9.10, which corrects the CORS policy so it no longer reflects arbitrary origins alongside credentialed access; see the advisory at https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-rwpc-36mg-fpvf. If you cannot upgrade immediately, disable the DisableAuthForLocalAddresses option so the API requires real authentication rather than trusting source IP-this breaks the confused-deputy chain at the cost of forcing local clients to authenticate. As additional interim controls, restrict the Cleanuparr web/API port to a dedicated management VLAN or loopback and place it behind a reverse proxy that enforces a strict same-origin Access-Control-Allow-Origin allowlist (trade-off: may break legitimate cross-origin front-ends), and rotate the admin API key after upgrading in case it was already exposed.