Adguardhome vulnerabilities
3 vulnerabilities
Known vulnerabilities in Adguardhome, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-47703adguardteam · adguardhome +3 moreAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleAdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.CVSS6.3MediumEPSS0.14%PrioritiseCVE-2026-32136adguardteam · adguardhome +2 moreAdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication BypassAdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.CVSS9.8CriticalEPSS0.77%RoutineCVE-2022-32175adguardhome +2 moreAdGuardHome - CSRFIn AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules.CVSS5.4MediumEPSS0.34%