Home / Vulnerability Intelligence / CVE-2026-44183

CVE-2026-44183 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: May 12, 2026

Cleanuparr - Authentication Bypass

Published: May 12, 2026Updated: May 12, 2026Remote Exploitable

Overview

Cleanuparr < 2.9.10 contains an authentication bypass caused by improper parsing of the X-Forwarded-For header in TrustedNetworkAuthenticationHandler.ResolveClientIp, letting unauthenticated remote attackers bypass trusted-network checks and gain administrator access, exploit requires sending a spoofed local IP in the header.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Unauthenticated remote attackers can gain administrator access, leading to full control over the application.

Mitigation

Update to version 2.9.10 or later.

References

https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-8q44-v65j-jc3q

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 12, 2026

🔴 CVE-2026-44183 - Critical (9.8) Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44183/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 12, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-44183
Severity: Critical
CVSS Score: 9.8
Type: broken_authentication
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-290

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days