From version 3.0.0-beta up to, but not including, 3.0.2, the Readarr integration in Scraparr exposed the configured Readarr API key as the value of the alias metric label. The primary impact is disclosure of a credential that could be used to authenticate to the Readarr instance, potentially granting an attacker full control over the system. The weakness underlying this vulnerability is a failure to mask or protect sensitive data before exposing it in publicly accessible metrics, which aligns with CWE‑200.

The affected product is Scraparr, a Prometheus exporter for the *arr Suite, developed by thecfu. Versions from 3.0.0‑beta through 3.0.1 are vulnerable. The vulnerability is addressed in release 3.0.2 and later. Users who have enabled the Readarr scraping feature, have not configured an alias for the metric, and have left the /metrics endpoint publicly accessible are at risk.

The CVSS score of 9.1 indicates high severity, and the EPSS score of less than 1% suggests low but non‑zero exploitation probability. The vulnerability can be exploited remotely by any actor who can reach the /metrics endpoint and the Readarr service; therefore, any organization with the exporter exposed to the internet or an untrusted network segment faces a significant risk. The vulnerability is not listed in CISA's KEV catalog.