Media Sharing Vulnerability in Jack by RozisCoding

CVE-2026-62979

What is CVE-2026-62979?

The Jack application, utilized for sharing media libraries via Radarr/Sonarr, has a vulnerability that allows for the exposure of sensitive internal information. Specifically, versions prior to 0.1.0 improperly handle error responses by serializing raw FetchError objects, leading to the inclusion of confidential details in HTTP responses. This mismanagement enables clients with access to shared peer API keys and requisite Cloudflare Access credentials to invoke errors without user interaction, potentially exposing critical keys and secrets. Notably, endpoints such as /peer/items/:id and /servers/health could disclose the internal keys of the media server, while the GET /torznab/download/:id may reveal peer secrets. This security flaw breaches the intended separation between shared peer access and private backend information, posing significant risks if not addressed. The issue has been resolved in version 0.1.0.

References