roziscoding jack: Exposure of backend credentials in error responses
Summary
jack, a tool for sharing media libraries between friends via Radarr/Sonarr, returns raw error objects in HTTP responses. These responses can include internal headers such as the Radarr/Sonarr X-Api-Key and connector secrets like CF-Access-Client-Secret. An attacker holding a shared peer API key (plus Cloudflare Access credentials if the deployment requires them) can trigger errors and read these credentials, which grant full administrative control of the affected Radarr/Sonarr instance.
Affected
- roziscoding jack versions prior to 0.1.0
- Earlier versions affected: Unknown.
Fixed in
- Fixed in version 0.1.0 (commit 2b296b5137acca476f34a23b692dd8c04ae1f148).
Workaround
- No vendor workaround known.
- Limit who holds peer API keys and restrict access to jack endpoints until upgraded.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV according to a third-party tracker (not confirmed on the CISA site).
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Upgrade roziscoding jack to version 0.1.0 or later.
- If an upgrade is not possible immediately, restrict peer API key distribution and limit access to jack.
- Rotate Radarr/Sonarr API keys and Cloudflare Access secrets that may have been served by an unpatched instance.
- Review who holds peer keys and remove unneeded peers.
- Relevance for businesses is low; check whether jack or an exposed Radarr/Sonarr is running in your environment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8gw5-7585-4997 github.com
- Fix commit 2b296b5 github.com
- Release v0.1.0 github.com
- VulDB entry 429412 vuldb.com
- OffSeq Radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:45.
Original description (NVD)
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.