CVE-2026-41448: AdGuard Home Auth Bypass Vulnerability

CVE-2026-41448 Overview

CVE-2026-41448 is an authentication bypass vulnerability in AdGuard Home when launched with the --glinet flag. The flaw resides in the authglinet middleware, which constructs token file paths through unsanitized string concatenation. Attackers can supply a path traversal sequence inside the Admin-Token cookie to redirect file reads to arbitrary paths on disk. Successful exploitation grants full administrative access to the AdGuard Home interface without credentials. The issue is categorized under CWE-22 (Path Traversal) and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can bypass authentication and gain full administrator control of AdGuard Home instances started with the --glinet flag.

Affected Products

AdGuard Home versions prior to v0.107.77 started with the --glinet flag
GL.iNet router deployments that bundle AdGuard Home with --glinet integration enabled
Self-hosted AdGuard Home installations using the GL.iNet compatibility mode

Discovery Timeline

2026-06-08 - CVE-2026-41448 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-41448

Vulnerability Analysis

The vulnerability exists in the authglinet middleware responsible for validating session tokens when AdGuard Home is started with the --glinet flag. This middleware reads a token file whose path is built by concatenating a base directory with the value of the Admin-Token cookie supplied by the client. Because the cookie value is not sanitized or validated against directory traversal sequences, an attacker controls part of the file path resolved by the server.

By submitting a crafted Admin-Token cookie containing ../ traversal characters, an attacker can redirect the file read to any path readable by the AdGuard Home process. When the middleware reads a file whose contents the attacker can predict or control, the comparison logic treats the request as authenticated. The result is full administrator access to the AdGuard Home web interface and DNS configuration.

Root Cause

The root cause is unsanitized string concatenation when constructing a file path from untrusted input. The authglinet middleware combines a base token directory with the raw Admin-Token cookie value without canonicalizing the resulting path or rejecting traversal sequences. This pattern matches CWE-22, where external input is used to build a pathname that resolves outside the intended directory.

Attack Vector

The attack vector is fully network-based. An attacker sends an HTTP request to the AdGuard Home web interface with an Admin-Token cookie containing a path traversal payload pointing to a file the attacker can predict or control on the host. The middleware reads that file, compares its contents to the cookie, and issues an authenticated session for the admin interface. No prior credentials, user interaction, or local access are required. See the VulnCheck Advisory for AdGuard Home for the published technical analysis.

Detection Methods for CVE-2026-41448

Indicators of Compromise

HTTP requests to AdGuard Home containing Admin-Token cookies with ../ or URL-encoded %2e%2e%2f traversal sequences
Web server access logs showing unauthenticated requests followed by successful access to /control/ administrative endpoints
Unexpected modifications to AdGuard Home DNS filtering rules, upstream servers, or admin credentials
AdGuard Home processes started with the --glinet flag on systems not running GL.iNet firmware

Detection Strategies

Inspect HTTP request logs and reverse-proxy logs for Admin-Token cookie values containing path separators or encoded traversal characters
Alert on administrative configuration changes that are not correlated with a preceding authenticated login event
Monitor for AdGuard Home command-line arguments containing --glinet to enumerate exposed instances

Monitoring Recommendations

Forward AdGuard Home access logs and host process telemetry to a central log platform for retention and correlation
Baseline normal Admin-Token cookie formats and flag deviations such as non-hex characters or excessive length
Track outbound DNS configuration changes from AdGuard Home as a high-fidelity post-exploitation signal

How to Mitigate CVE-2026-41448

Immediate Actions Required

Upgrade AdGuard Home to version v0.107.77 or later, which contains the fix referenced in the GitHub AdGuardHome Release Note
Restrict network exposure of the AdGuard Home web interface to trusted management networks only
Audit running instances for the --glinet flag and remove it where the GL.iNet integration is not required

Patch Information

The AdGuard team released v0.107.77 to address CVE-2026-41448. The fix sanitizes the Admin-Token cookie value before it is used in file path construction within the authglinet middleware. Administrators should apply the upgrade immediately on any host that launches AdGuard Home with the --glinet flag. Refer to the GitHub AdGuardHome Release Note for upgrade instructions and full release contents.

Workarounds

Remove the --glinet flag from the AdGuard Home startup command if GL.iNet compatibility is not required, then restart the service
Place AdGuard Home behind a reverse proxy that strips or validates the Admin-Token cookie and rejects traversal sequences
Block external access to the AdGuard Home administrative port at the firewall and require VPN access for management

bash

# Example: verify AdGuard Home version and remove the --glinet flag
AdGuardHome --version
systemctl cat AdGuardHome | grep -- '--glinet'
# Edit the unit file or launch script to remove --glinet, then:
systemctl daemon-reload
systemctl restart AdGuardHome