Executive Summary

CVE-2026-41448 is a critical authentication bypass vulnerability in AdGuard Home when started with the --glinet flag. It allows unauthenticated attackers to gain full administrative access by exploiting a path traversal flaw in the Admin-Token cookie.

The vulnerability arises from unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a path traversal sequence in the Admin-Token header, which redirects file reads to arbitrary paths, bypassing authentication controls.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows unauthenticated attackers to gain full administrative access to the AdGuard Home system.

• Attackers can bypass authentication mechanisms completely.
• Unauthorized users can control and manipulate the system settings and data.
• Potential exposure of sensitive information and disruption of network filtering services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP requests that include suspicious or crafted path traversal sequences in the Admin-Token cookie or header.

You can use network traffic inspection tools like tcpdump or Wireshark to capture HTTP requests and look for Admin-Token headers containing path traversal patterns such as "../".

• Example tcpdump command to capture HTTP traffic on port 80 or 443: tcpdump -A -s 0 'tcp port 80 or tcp port 443'
• Use grep or similar tools to filter captured traffic for Admin-Token headers with traversal sequences: grep -i 'Admin-Token: .*\.\./' captured_traffic.txt

Additionally, reviewing server logs for unusual Admin-Token values containing path traversal sequences can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade AdGuard Home to version 0.107.77 or later, where this vulnerability has been fixed.

If upgrading immediately is not possible, avoid starting AdGuard Home with the --glinet flag, as the vulnerability is triggered only when this flag is used.

Monitor and block suspicious requests containing path traversal sequences in the Admin-Token header to reduce risk until the patch is applied.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to gain full administrative access to AdGuard Home when started with the --glinet flag by exploiting a path traversal flaw in the Admin-Token cookie. This unauthorized access could lead to exposure or manipulation of sensitive data managed by the system.

Such unauthorized administrative access can compromise the confidentiality, integrity, and availability of data, potentially violating compliance requirements under standards like GDPR and HIPAA, which mandate strict access controls and protection of personal and sensitive information.

Useful 0 Not Useful 0