PT-2026-40331 · Unknown · Cleanuparr

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-44184

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cleanuparr versions prior to 2.9.10

Description The global CORS (Cross-Origin Resource Sharing) policy reflects every request Origin and combines it with AllowCredentials(). When the DisableAuthForLocalAddresses setting is enabled, the API authenticates requests based solely on the source IP through the TrustedNetworkAuthenticationHandler() function. This combination allows any website visited by an administrator or a user on a trusted IP to read authenticated API responses cross-origin, which may include the administrator's permanent API key.

Recommendations Update to version 2.9.10.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-942

CWE-346

Related Identifiers

CVE-2026-44184

Affected Products

Cleanuparr

References · 4

• 🔥 https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-rwpc-36mg-fpvf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44184 · Security Note
• https://t.me/CVEtracker/53537 · Telegram Post
• https://twitter.com/CVEnew/status/2054340982624153903 · Twitter Post