CVE-2026-26069 is a vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) affecting Scraparr, a Prometheus exporter for the *arr suite of applications. Specifically, versions from 3.0.0-beta up to but not including 3.0.2 expose the configured Readarr API key as an alias metric label value when the Readarr integration is enabled and no alias is configured. This exposure occurs through the /metrics HTTP endpoint, which is designed to provide Prometheus with monitoring data. If this endpoint is accessible externally or to unauthorized users, and the Readarr instance itself is externally accessible, the API key can be extracted by attackers. The API key is a sensitive credential that could allow unauthorized access to the Readarr service, potentially leading to further compromise or data leakage. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high confidentiality impact (VC:H), with scope and integrity impacts limited. The vulnerability was published on February 12, 2026, and is fixed in Scraparr version 3.0.2. No known exploits are reported in the wild at this time.

For European organizations, this vulnerability poses a significant risk if Scraparr is deployed with Readarr integration enabled and the /metrics endpoint is exposed to unauthorized users. The disclosure of the Readarr API key can lead to unauthorized access to Readarr instances, potentially allowing attackers to manipulate media management workflows, access sensitive metadata, or pivot to other internal systems. This can result in confidentiality breaches and operational disruptions. Organizations using Scraparr in production environments, especially those exposing monitoring endpoints externally or lacking proper network segmentation, are at higher risk. The impact is amplified in environments where Readarr manages critical or sensitive content. Additionally, the exposure of API keys can facilitate further attacks or lateral movement within the network. Given the critical CVSS score of 9.1, the vulnerability demands immediate attention to prevent potential data breaches and service interruptions.

European organizations should immediately upgrade Scraparr to version 3.0.2 or later, where the vulnerability is fixed. Until the upgrade is applied, organizations must restrict access to the /metrics endpoint by implementing network-level controls such as firewall rules or VPN access to ensure it is not accessible externally or to unauthorized users. Configuring an alias for the Readarr integration in Scraparr can also prevent the API key from being exposed as a metric label. Additionally, organizations should audit their Readarr instances to ensure they are not unnecessarily exposed to the internet and implement strong access controls and authentication mechanisms. Monitoring and logging access to the /metrics endpoint can help detect potential unauthorized access attempts. Finally, consider rotating the Readarr API keys if exposure is suspected or confirmed to limit the window of exploitation.