Jack
Monthly
jack prior to 0.1.0 serializes raw upstream FetchError objects into HTTP error responses, so an authenticated peer can read back the outbound request headers jack used - including the internal Radarr/Sonarr X-Api-Key and connector secrets such as CF-Access-Client-Secret. Exploitation requires only the shared peer API key sent as X-Api-Key (PR:L) plus valid Cloudflare Access service-token headers if the deployment is CF-Access gated; the attacker then forces an upstream non-2xx or schema-validation failure through GET /peer/items/:id or GET /servers/health (leaking the *arr key) or GET /torznab/download/:id (leaking another peer's key and CF Access secrets), with no race and no user interaction. The GitHub security advisory publishes detailed reproduction steps, but no confirmed working exploit tooling and no CISA KEV listing; the flaw is fixed in version 0.1.0 and carries a vendor-prioritized 'this week' remediation label.
jack prior to 0.1.0 serializes raw upstream FetchError objects into HTTP error responses, so an authenticated peer can read back the outbound request headers jack used - including the internal Radarr/Sonarr X-Api-Key and connector secrets such as CF-Access-Client-Secret. Exploitation requires only the shared peer API key sent as X-Api-Key (PR:L) plus valid Cloudflare Access service-token headers if the deployment is CF-Access gated; the attacker then forces an upstream non-2xx or schema-validation failure through GET /peer/items/:id or GET /servers/health (leaking the *arr key) or GET /torznab/download/:id (leaking another peer's key and CF Access secrets), with no race and no user interaction. The GitHub security advisory publishes detailed reproduction steps, but no confirmed working exploit tooling and no CISA KEV listing; the flaw is fixed in version 0.1.0 and carries a vendor-prioritized 'this week' remediation label.