CVE-2026-44183: Cleanuparr: authentication bypass via spoofed X-Forwarded-For in reverse-proxy mode
Cleanuparr versions before 2.9.10 take the leftmost X-Forwarded-For entry as the client IP when reverse-proxy trusted-network mode is enabled, and that value is controlled by the remote client. This lets an unauthenticated remote attacker be logged in as the administrator. The record rates it Critical (CVSS 3.1 base score 9.8), states it is fixed in 2.9.10, and does not list it in CISA KEV.
Overview
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr and supported download clients such as qBittorrent. CVE-2026-44183 affects the trusted-network authentication handler, which uses the leftmost value of the X-Forwarded-For header as the client IP when reverse-proxy mode is enabled. Because the leftmost value originates from the client, it cannot be trusted for access decisions.
Impact
The record describes an unauthenticated remote attacker being logged in as the Cleanuparr administrator. The CVSS 3.1 vector in the record indicates a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
Affected products and versions
- Cleanuparr, all versions before 2.9.10 according to the record.
- Deployments with reverse-proxy trusted-network mode enabled are the scenario described.
The record's fixes list is empty, but the description states the issue is fixed in 2.9.10.
Exploitation status
The record shows CVE-2026-44183 is not listed in the CISA KEV catalog, so no active exploitation is recorded there. No confirmed exploitation appears in the sources consulted. The SSVC data in the record lists exploitation as proof of concept, which is an assessment category and not evidence of attacks in the wild. The EPSS probability in the record is 0.00329 with a percentile of 0.24242.
Remediation and mitigation
- Upgrade Cleanuparr to version 2.9.10 or later.
- If reverse-proxy trusted-network mode is not required, disable it until the upgrade is complete.
- Restrict access to the administrative interface to trusted management networks while patching.
- Ensure the reverse proxy overwrites or strips client-supplied forwarding headers instead of passing them through.
- Review any access control that relies on client IP addresses.
Detection guidance
- Review authentication logs for administrator sessions from unexpected source addresses, or sessions recording private or local client IPs that do not match your network layout.
- Compare reverse-proxy access logs with application logs to find requests whose forwarding headers do not match the actual upstream hop.
- Treat unexplained administrator logins or configuration changes as potential compromise and investigate them.
Limitations of the available information
The record does not provide full advisory text, version-level testing beyond the stated range, or an entry in the fixes list. The source status is recorded as Deferred. Exploit path details are intentionally omitted here. Consult the GitHub security advisory for vendor-specific guidance.
Frequently asked questions
Which Cleanuparr versions are affected by CVE-2026-44183?
According to the record, versions before 2.9.10 are affected, and the description states the issue is fixed in 2.9.10.
Does this vulnerability require authentication to exploit?
The record describes an unauthenticated remote attacker and a CVSS vector with no privileges required, so the vulnerability is rated as not requiring authentication.
Is this CVE known to be actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.