Adguardteam Adguardhome vulnerabilities
3 vulnerabilities
Known vulnerabilities in Adguardteam Adguardhome, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-47703adguardteam · adguardhome +3 moreAdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleAdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.CVSS6.3MediumEPSS0.14%PrioritiseCVE-2026-41448adguardteam · adguardhomeAdGuard Home Authentication Bypass via Path Traversal in Admin-Token CookieAdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.CVSS9.4CriticalEPSS0.54%PrioritiseCVE-2026-32136adguardteam · adguardhome +2 moreAdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication BypassAdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.CVSS9.8CriticalEPSS0.77%