Read the docs
TI-2026-30037 Aliases CVE-2026-41448GHSA-599m-gqxc-4x5m

AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie

Priority MEDIUM 48CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Fix Fixed AdGuardHome (AdguardTeam): 0.107.77

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdguardTeamAdGuardHomebefore 0.107.770.107.77Patch availableCNA
  • AdGuardHome VendorAdguardTeam Affected before 0.107.77 Fixed in 0.107.77 Patch available CNA

Remediation

  • Fix · CNA AdGuardHome (AdguardTeam) Fixed in 0.107.77

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41448
  2. 2026-10-03 Alias added: GHSA-599m-gqxc-4x5m
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences