CVE-2026-30975: 
NixOS vulnerability analysis and mitigation

CVE-2026-30975 is an authentication bypass vulnerability (CWE-290) in Sonarr, a PVR application for Usenet and BitTorrent users. It affects all Sonarr versions prior to 4.0.16.2942 and was disclosed on March 25, 2026, via a GitHub Security Advisory. The vulnerability specifically impacts installations where the "Authentication Required" setting is configured as "Disabled for Local Addresses" and no properly configured reverse proxy is in place. The GitHub advisory assigns a CVSS v3.1 score of 8.1 (High), while Feedly's aggregated data reflects a score of 9.8 (Critical) based on a different vector interpretation (GitHub Advisory).

The root cause is an improper implementation of the local-address authentication exemption feature, classified as CWE-290 (Authentication Bypass by Spoofing). Sonarr trusts the X-Forwarded-For HTTP header to determine whether a request originates from a local address; an attacker can craft a request with a spoofed X-Forwarded-For header value representing a local/trusted IP address, causing Sonarr to treat the remote request as local and bypass authentication entirely. Exploitation requires no privileges and low attack complexity, though the GitHub advisory notes user interaction is required in some configurations. The vulnerability was reported to the Sonarr team by researchers identified as "edmcboy" and "bart" (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to gain full access to the Sonarr web interface, enabling them to read and modify configuration settings, manage download clients, alter indexer configurations, and access user data — all without valid credentials. The confidentiality and integrity impacts are rated High, as an attacker could exfiltrate sensitive configuration data (including credentials for connected services like download clients and indexers) and tamper with media management settings. Availability impact is rated None in the official advisory. The vulnerability is particularly dangerous for Sonarr instances exposed directly to the internet (GitHub Advisory).

As of the time of reporting, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.055%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of required privileges make it straightforward to exploit against vulnerable, internet-exposed Sonarr instances once the bypass mechanism is understood (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Sonarr instances using tools like Shodan or Censys by searching for Sonarr's default port (8989) or its web UI fingerprint. Confirm the target is running a version prior to 4.0.16.2942.
2. Identify authentication configuration: Attempt to access the Sonarr web UI directly. If the instance uses "Disabled for Local Addresses" authentication mode without a properly configured reverse proxy, it may be susceptible.
3. Craft spoofed request: Send an HTTP request to the Sonarr instance with a spoofed X-Forwarded-For header set to a local/trusted IP address (e.g., X-Forwarded-For: 127.0.0.1 or X-Forwarded-For: 192.168.1.1).
4. Bypass authentication: Sonarr incorrectly trusts the spoofed header and treats the request as originating from a local address, granting unauthenticated access to the web interface.
5. Achieve objective: With full access to the Sonarr UI, the attacker can exfiltrate credentials stored in download client or indexer configurations, modify settings, or pivot to connected services (GitHub Advisory).

• Network: Unexpected HTTP requests to Sonarr's web interface (default port 8989) from external/non-local IP addresses containing X-Forwarded-For headers with local IP values (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16.x.x).
• Logs: Sonarr access logs showing successful authenticated sessions from IP addresses that do not match the configured local network range; repeated access to configuration or settings endpoints from unfamiliar source IPs.
• Logs: Web server or reverse proxy logs showing requests with anomalous or injected X-Forwarded-For header values that differ from the actual connecting IP address.
• File System: Unexpected changes to Sonarr's config.xml or database files indicating configuration modification by an unauthorized party.
• Process/Behavior: Unusual download activity or new indexer/download client configurations added without administrator action.

Sonarr has released patched versions addressing this vulnerability: 4.0.16.2942 for the nightly/develop branch and 4.0.16.2944 for stable/main releases — upgrading to either is the recommended remediation (Sonarr Release 2942, Sonarr Release 2944). For users unable to upgrade immediately, the following workarounds should be applied in priority order:

1. Change Sonarr's "Authentication Required" setting from "Disabled for Local Addresses" to "Enabled" to require authentication for all connections.
2. Deploy Sonarr behind a reverse proxy properly configured to validate and strip/overwrite the X-Forwarded-For header before passing requests to Sonarr.
3. Do not expose Sonarr directly to the internet; restrict access via a VPN, Tailscale, or similar secure tunneling solution (GitHub Advisory).

The vulnerability was noted on Mastodon by security-focused accounts shortly after disclosure, and was picked up by CVE aggregation services including cvefeed.io and VulnDB within hours of publication. The Sonarr development team (credited to maintainer markus101) responded promptly with patches released the same day as disclosure. No major media coverage or significant researcher commentary beyond the official advisory has been identified (GitHub Advisory).