PT-2026-28129 · Sonarr · Sonarr

Bart + 1 · Publicado 2026-03-25 · Atualizado 2026-03-26 · CVE-2026-30975

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sonarr versions prior to 4.0.16.2942

Description Sonarr is a PVR for Usenet and BitTorrent users. A flaw exists where authentication could be bypassed in versions with authentication disabled for local addresses (Authentication Required set to: Disabled for Local Addresses) if a reverse proxy was not in place or did not properly handle headers. The issue affects the Authentication Required setting.

Recommendations Update to version 4.0.16.2942 or later. Ensure Sonarr's Authentication Required setting is set to Enabled. Run Sonarr behind a reverse proxy. Avoid exposing Sonarr directly to the internet; use a VPN or Tailscale instead.

Exploit

Correção

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2026-30975

GHSA-H5QX-5HJF-7C9R

Produtos afetados

Sonarr

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30975.json · Exploit
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2942 · Nota
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h5qx-5hjf-7c9r · Aviso do Fabricante
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2944 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-30975 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-30975 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037137801917890978 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2037139195555143764 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2036921036185403476 · Publicação no Twitter