CVE-2026-30975 - Vulnerability Analysis

Overview

Sonarr < 4.0.16.2942 contains an authentication bypass caused by disabled authentication for local addresses without a reverse proxy passing invalid headers, letting attackers bypass authentication, exploit requires specific configuration.

Severity & Score

Impact

Attackers can bypass authentication, gaining unauthorized access to the application and its data.

Mitigation

Update to version 4.0.16.2942 or later.

References

• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2942
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2944
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h5qx-5hjf-7c9r

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 25, 2026

🟠 CVE-2026-30975 - High (8.1) Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had disabled authentication for local addresses (Authentication Required set to: `Disabled for Local Addresses`) ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30975/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner