Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-41448 – Authentication Bypass – AdGuard Home prior to v0.107.77

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-41448 is a critical authentication bypass vulnerability in AdGuard Home affecting instances started with the --glinet flag, a mode used by GL.iNet routers that ship with AdGuard Home integrated as part of their standard firmware. The flaw stems from unsanitized string concatenation in the token file path construction within the authglinet middleware, allowing unauthenticated remote attackers to supply a path traversal sequence in the Admin-Token cookie or header to redirect file reads to arbitrary filesystem paths and gain full administrative control without valid credentials. The vulnerability carries a CVSS 4.0 score of 9.2 (Critical) and was patched in AdGuard Home v0.107.77, released June 1, 2026.

Technical details

  • Root cause: Unsanitized string concatenation in the authglinet middleware’s token file path construction allows attacker-controlled input to escape the intended directory and redirect the file read used for token validation to an arbitrary path on the filesystem.
  • Trigger condition: AdGuard Home must be running with the --glinet flag. This flag enables GL.iNet compatibility mode, in which authentication is delegated to a separate token-file mechanism rather than the standard login flow. GL.iNet routers invoke this flag as part of their integrated firmware configuration.
  • Attack vector: An unauthenticated remote attacker crafts an HTTP request carrying a path traversal sequence (e.g., ../../) in the Admin-Token cookie or header. Because the value is concatenated into a file path without sanitization, the middleware reads a file of the attacker’s choosing and accepts it as a valid token, bypassing authentication entirely.
  • Impact: Successful exploitation grants full administrative access to the AdGuard Home web interface. An attacker in this position can alter upstream DNS resolvers to redirect network traffic, disable content filtering and ad-blocking rules, modify DHCP settings, and exfiltrate DNS query logs for all clients on the network behind the device.

Affected software

  • AdGuard Home: all versions prior to v0.107.77 when started with the --glinet flag (primarily GL.iNet router deployments with AdGuard Home enabled)

Severity

CVSS 4.0 base score: 9.2 (Critical)
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Mitigation and recommended actions

  • Immediate: Upgrade AdGuard Home to v0.107.77 or later. The release explicitly addresses this flaw: "Authorization in GLiNET mode is no longer vulnerable to path traversal attacks."
  • GL.iNet router users: Verify whether your router firmware delivers an updated AdGuard Home binary at v0.107.77 or above; if not, manually update the AdGuard Home installation to the patched version.
  • Network mitigation (if patching is delayed): Restrict external access to the AdGuard Home web interface (typically TCP port 3000) at the network perimeter so that the admin panel is not reachable from the WAN.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge