CVE-2026-30975 PUBLISHED

Sonarr Authentication Bypass vulnerability

Assigner: GitHub_M
Reserved: 07.03.2026 Published: 25.03.2026 Updated: 26.03.2026

Sonarr is a PVR for Usenet and BitTorrent users. Versions prior to 4.0.16.2942 have an authentication bypass that affected users that had disabled authentication for local addresses (Authentication Required set to: Disabled for Local Addresses) without a reverse proxy running in front of Sonarr that didn't not pass through the invalid header. Patches are available in version 4.0.16.2942 in the nightly/develop branch and version 4.0.16.2944 for stable/main releases. Some workarounds are available. Make sure Sonarr's Authentication Required setting is set to Enabled, run Sonarr behind a reverse proxy, and/or do not expose Sonarr directly to the internet and instead rely on accessing it through a VPN, Tailscale or a similar solution.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 8.1

Product Status

Vendor Sonarr
Product Sonarr
Versions
  • Version < 4.0.16.2942 is affected

References

Problem Types

  • CWE-290: Authentication Bypass by Spoofing CWE