{"id":"CVE-2026-62979","kind":"vulnerability","aliases":["CVE-2026-62979"],"related":[],"title":"jack: error responses leak internal Radarr and Sonarr API keys","description":"jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.","summary":"jack returns raw error objects over HTTP, and those errors include outbound request headers. An attacker with the shared peer key can read the internal Radarr/Sonarr X-Api-Key and Cloudflare Access secrets, which grants full administrative control of those instances.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudflare-access","jack","other","radarr","self-hosted","sonarr"],"not_affected_if":["no-radarr-or-sonarr-connector","version-0.1.0-or-later"],"how_to_check":"- Check the installed jack version; releases before `0.1.0` are affected.\n- Look for `GET /peer/items/:id`, `GET /servers/health` and `GET /torznab/download/:id` routes in your deployment.\n- Check whether the Radarr/Sonarr connectors send `X-Api-Key` or `CF-Access-Client-Secret` headers.","fix":"- jack: upgrade to `0.1.0` or later.","status":"open","published_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:54+00:00","triaged_at":"2026-10-30T21:26:39+00:00","updated_at":"2026-10-30T21:26:39+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T21:26:39Z","model":"claude-haiku-5-5","output":{"fix":"- jack: upgrade to `0.1.0` or later.","reach":"unknown","title":"jack: error responses leak internal Radarr and Sonarr API keys","impact":"high","summary":"jack returns raw error objects over HTTP, and those errors include outbound request headers. An attacker with the shared peer key can read the internal Radarr/Sonarr X-Api-Key and Cloudflare Access secrets, which grants full administrative control of those instances.","audience":"businesses","category":"other","nicknames":[],"who_cares":["jack","radarr","sonarr","self-hosted","cloudflare-access"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker gets internal Radarr and Sonarr keys, full admin control","analyst_note":"","how_to_check":"- Check the installed jack version; releases before `0.1.0` are affected.\n- Look for `GET /peer/items/:id`, `GET /servers/health` and `GET /torznab/download/:id` routes in your deployment.\n- Check whether the Radarr/Sonarr connectors send `X-Api-Key` or `CF-Access-Client-Secret` headers.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.1.0-or-later","no-radarr-or-sonarr-connector"],"who_is_affected":"Deployments running jack before `0.1.0` that connect to Radarr or Sonarr are exposed, since the leaked keys come from upstream error responses. Exposure needs a valid shared peer API key, and Cloudflare Access credentials too if the deployment requires them. Installs on `0.1.0` or later, or setups without these connectors, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001255,"input_tokens":4465,"output_tokens":1617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62979':13A,16A '/items':213C '/peer/items':183C '/peer/search':211C '/servers/health':187C '/torznab/download':198C '0.1.0':85C,253C 'access':19B,59B,142C,165C,208C,242C 'administr':64B,227C 'affect':221C 'anoth':202C 'api':9A,55B,132C,161C 'attach':95C 'attack':42B 'backend':245C 'boundari':237C 'catch':215C 'cf':141C 'cf-access-client-secret':140C 'client':143C,156C 'cloudflar':18B,58B,164C,207C 'cloudflare-access':17B 'connector':136C 'control':65B,228C 'correspond':231C 'credenti':166C,246C 'cross':234C 'custom':135C 'cve':11A,14A 'deploy':171C 'disclos':222C 'emit':120C 'enumer':117C 'error':2A,30B,36B,175C,217C 'expos':189C,201C 'extra':112C 'failur':109C 'fetcherror':89C 'field':113C 'fix':250C 'forc':173C 'friend':239C 'full':63B,226C 'get':182C,186C,197C 'grant':62B,225C 'header':40B,98C,125C,137C 'host':25B 'http':33B,92C 'id':184C,199C 'includ':37B,126C 'instanc':68B,233C 'intend':236C 'interact':181C 'intern':5A,51B,128C,191C,223C 'issu':248C 'jack':1A,20B,27B,69C 'json':122C 'key':10A,47B,56B,133C,162C,195C,205C,224C 'leak':4A 'let':70C 'lib/errors/fetcherror.ts':115C 'lib/redact.ts':145C 'lib/servers/base.ts':94C 'librari':74C 'log':147C 'media':73C,193C 'media-serv':192C 'middleware/handle-error.ts':86C 'non':102C 'non-success':101C 'object':31B,90C 'outbound':38B,96C 'path':154C 'peer':46B,80C,82C,160C,203C,241C 'peer-to-p':79C 'plus':163C 'prior':83C 'privat':244C 'public':111C 'race':178C 'radarr':6A,22B 'radarr/sonarr':52B,77C,129C,232C 'raw':29B,88C 'read':49B 'redact':146C 'remain':116C 'request':39B,97C 'requir':168C 'respons':3A,93C,104C,153C 'return':28B 'rout':214C 'schema':107C 'schema-valid':106C 'secret':60B,144C,209C 'self':24B 'self-host':23B 'serial':87C,123C 'server':194C 'share':45B,72C,159C,240C 'sonarr':8A,26B 'span':149C 'stack':78C 'success':103C 'upstream':100C 'user':71C,180C 'valid':108C 'version':252C 'without':176C 'x':54B,131C 'x-api-key':53B,130C","nicknames":[],"mitigations":[],"who_affected":"Deployments running jack before `0.1.0` that connect to Radarr or Sonarr are exposed, since the leaked keys come from upstream error responses. Exposure needs a valid shared peer API key, and Cloudflare Access credentials too if the deployment requires them. Installs on `0.1.0` or later, or setups without these connectors, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62979","severity":null,"published_at":"2026-10-30T21:17:15+00:00","modified_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:54+00:00","fetched_at":"2026-10-30T21:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}