Vulnerability · Published Mar 25, 2026 · Assigned by GitHub_M

CVE-2026-30975Sonarr Authentication Bypass vulnerability

High 8.1

In plain English

A high-severity authentication bypass by spoofing in Sonarr from Sonarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had disabled authentication for local addresses (Authentication Required set to: `Disabled for Local Addresses`) without a reverse proxy running in front of Sonarr that didn't not pass through the invalid header. Patches are available in version 4.0.16.2942 in the nightly/develop branch and version 4.0.16.2944 for stable/main releases. Some workarounds are available. Make sure Sonarr's Authentication Required setting is set to `Enabled`, run Sonarr behind a reverse proxy, and/or do not expose Sonarr directly to the internet and instead rely on accessing it through a VPN, Tailscale or a similar solution.

Affected products (as reported)

Vendor	Product	Versions
Sonarr	Sonarr	< 4.0.16.2942

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h5qx-5hjf-7c9r x_refsource_CONFIRM
https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2942 x_refsource_MISC
https://github.com/Sonarr/Sonarr/releases/tag/v4.0.16.2944 x_refsource_MISC