CVE-2026-30975: High Auth Bypass in Sonarr Local Address Mode

CVE-2026-30975 is a high severity authentication bypass (CVSS 8.1) in Sonarr before 4.0.16.2942, affecting setups that disable authentication for local addresses. Update to 4.0.16.2944 on the stable branch, or 4.0.16.2942 on nightly.

What's affected

Sonarr versions before 4.0.16.2942 are affected. This applies to installs where Authentication Required is set to Disabled for Local Addresses and no reverse proxy sits in front that strips the invalid header.

Patches are in 4.0.16.2942 on the nightly or develop branch and 4.0.16.2944 on the stable or main branch.

How to check if you're exposed

In Sonarr, open Settings, then General, and read the Authentication Required setting. The value Disabled for Local Addresses is the one the advisory names. Then open System, then Status, and read the version.

If you reach Sonarr through a reverse proxy, check whether it passes client supplied headers through unchanged.

What to do now

1. Update Sonarr to 4.0.16.2944 on stable, or 4.0.16.2942 or later on nightly.
2. Set Authentication Required to Enabled. The advisory lists this as a workaround.
3. Run Sonarr behind a reverse proxy, as the advisory also suggests.
4. Do not expose Sonarr directly to the internet. Use a VPN, Tailscale or a similar service instead.

Why it matters

The weakness class is CWE-290, authentication bypass by spoofing. When authentication is skipped for local addresses, the app has to decide whether a request really comes from a local address. A header supplied by the client could mislead that decision, so a remote request looked local.

The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog. Home media servers are often exposed for convenience, which is why the advisory stresses a VPN.

Quick check

Sources

• Sonarr security advisory GHSA-h5qx-5hjf-7c9r
• Sonarr v4.0.16.2944 release
• NVD record for CVE-2026-30975

Last reviewed: 19 October 2026.