jack: upstream error responses expose backend and peer credentials
Impact
jack versions prior to 0.1.0 expose backend and peer credentials through error responses. An attacker with a shared peer API key and Cloudflare Access credentials can force an error, disclosing internal keys. This grants full administrative control of the corresponding Radarr/Sonarr instance.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
roziscoding · GitHub_M
jack
1 range
roziscoding · GitHub_M
jack
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 0.1.0
Other versions: unknown
Original source description
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation failures; the public extras field in lib/errors/FetchError.ts remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr X-Api-Key and custom connector headers such as CF-Access-Client-Secret. lib/redact.ts redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. GET /peer/items/:id and GET /servers/health can expose the internal media-server key, while GET /torznab/download/:id can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-62979View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-62979
Observed 2026-10-30T22:16:41.389Z · upstream updated 2026-10-30T22:12:34.837Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T21:18:23.166510Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.