CVE-2026-62979— jack: upstream error responses expose backend and peer credentials

Quick assessment

Affected

roziscoding jack

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jack 允许用户通过 Radarr/Sonarr 技术栈以点对点方式共享媒体库。在 0.1.0 版本之前，会将原始的对象序列化为 HTTP 响应。会在上游非成功响应和模式验证失败时附加出站请求头；而中的公共字段仍保持可枚举状态，并会在 JSON 序列化时被发出。这些请求头包含了 Radarr/Sonarr 的内部以及自定义连接器头（如）。仅对日志和追踪跨度（spans）进行脱敏处理，并未覆盖该响应路径。任何拥有共享对等端 API 密钥（若部署需要，还需具备 Cloudflare Access 凭据

CVSS 8.4 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1048 · Exfiltration Over Alternative Protocol T1190 · Exploit Public-Facing Application T1552.004 · Private Keys

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

jack: upstream error responses expose backend and peer credentials

Source: CVE Program / CVE List V5

Vulnerability Description

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
roziscoding	jack	< 0.1.0	-

II. Public POCs for CVE-2026-62979

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62979

请登录查看更多情报信息。

Other References for CVE-2026-62979 (3)

https://github.com/roziscoding/jack/releases/tag/v0.1.0 x_refsource_MISC
https://github.com/roziscoding/jack/security/advisories/GHSA-8gw5-7585-4997 x_refsource_CONFIRM
https://github.com/roziscoding/jack/commit/2b296b5137acca476f34a23b692dd8c04ae1f148 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62979

IV. Related Vulnerabilities

Same weakness: CWE-200