CVE-2026-30975Sonarr is a PVR for Usenet and BitTorrent users.
Updated under an hour ago ()
Does this affect you?
It affects sonarr. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had disabled authentication for local addresses (Authentication Required set to: `Disabled for Local Addresses`) without a reverse proxy running in front of Sonarr that didn't not pass through the invalid header. Patches are available in version 4.0.16.2942 in the nightly/develop branch and version 4.0.16.2944 for stable/main releases. Some workarounds are available. Make sure Sonarr's Authentication Required setting is set to `Enabled`, run Sonarr behind a reverse proxy, and/or do not expose Sonarr directly to the internet and instead rely on accessing it through a VPN, Tailscale or a similar solution.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-290
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
sonarr sonarr sonarr:sonarr | before 4.0.16.2942 | NVD |
References
- https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2942release-notes
- https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2944release-notes
- https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h5qx-5hjf-7c9rvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.