Is CVE-2026-44184 actively exploited?

No active exploitation of CVE-2026-44184 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44184 be exploited remotely?

Partially. CVE-2026-44184 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-44184?

CVE-2026-44184 has a CVSS score of 8.0 (HIGH).

HOME VULNERABILITIESCVE-2026-44184

HIGH

CVE-2026-44184

CWE-346Published: May 12, 2026· Updated: May 13, 2026

8.0

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.6th

Official Description

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthenticationHandler. The combination lets any website that an admin (or any user on a trusted IP) visits read authenticated API responses cross-origin — including the admin's permanent API key. This vulnerability is fixed in 2.9.10.

NVD Source

Technical Analysis

CVE-2026-44184 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.0.