CVE-2026-41448: AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie

Vulnerability summary

CVE-2026-41448 is a critical (CVSS 9.4) vulnerability in adguardteam adguardhome. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 45.6% of scored vulnerabilities.

Timeline

1. 08-06-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.