CVE-2026-62979

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.

• CWE-200
• CWE-209

• https://github.com/roziscoding/jack/commit/2b296b5137acca476f34a23b692dd8c04ae1f148
• https://github.com/roziscoding/jack/releases/tag/v0.1.0
• https://github.com/roziscoding/jack/security/advisories/GHSA-8gw5-7585-4997

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62963Centrifugo is an open-source scalable real-time messaging se…8.7
• CVE-2026-62965SABnzbd is an open source automated Usenet download tool. Pr…7
• CVE-2026-62966ESPAsyncWebServer is an asynchronous HTTP and WebSocket serv…7.5
• CVE-2026-62967ZTNET is a ZeroTier web UI for private controllers with mult…8.1
• CVE-2026-62968Dream Displays provides in-game screens for streaming videos…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3
• CVE-2026-62982Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-62985request-filtering-agent is an http(s).Agent implementation t…7.5
• CVE-2026-62986OpenEXR is the reference implementation and specification fo…4.3
• CVE-2026-62987Fabio is an HTTP(S) and TCP router for deploying application…5.8
• CVE-2026-62988Froxlor is open source server administration software. From …9