PT-2026-28129 · Sonarr · Sonarr

Bart + 1 · Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-30975

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sonarr versions prior to 4.0.16.2942

Description Sonarr is a PVR for Usenet and BitTorrent users. A flaw exists where authentication could be bypassed in versions with authentication disabled for local addresses (Authentication Required set to: Disabled for Local Addresses) if a reverse proxy was not in place or did not properly handle headers. The issue affects the Authentication Required setting.

Recommendations Update to version 4.0.16.2942 or later. Ensure Sonarr's Authentication Required setting is set to Enabled. Run Sonarr behind a reverse proxy. Avoid exposing Sonarr directly to the internet; use a VPN or Tailscale instead.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-30975

GHSA-H5QX-5HJF-7C9R

Affected Products

Sonarr

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30975.json · Exploit
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h5qx-5hjf-7c9r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30975 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30975 · Vendor Advisory
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2942 · Note
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2944 · Note
• https://twitter.com/CVEnew/status/2037137801917890978 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037139195555143764 · Twitter Post
• https://twitter.com/TheHackerWire/status/2036921036185403476 · Twitter Post