Skip to main content
Mallory
Critical

Authentication Bypass via Path Traversal in AdGuard Home --glinet Mode

IdentifiersCVE-2026-41448CWE-22· Improper Limitation of a Pathname…

CVE-2026-41448 is an authentication bypass vulnerability in AdGuard Home that is exposed when the product is started with the --glinet flag. The flaw is in the authglinet middleware, where the value supplied in the Admin-Token cookie or header is incorporated into the token file path using unsanitized string concatenation. By supplying path traversal sequences in the Admin-Token value, an unauthenticated attacker can cause the application to read from attacker-selected filesystem paths instead of the intended token file location. This breaks the authentication logic and can result in full administrative access to the AdGuard Home instance.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication and obtain full administrative access to the affected AdGuard Home instance. Based on the provided CVSS information, the vulnerability has high confidentiality and integrity impact and low availability impact. In practice, this can enable unauthorized access to administrative functionality, exposure of sensitive configuration or operational data, and unauthorized modification of system or application settings.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, avoid running AdGuard Home with the --glinet flag unless it is strictly required. Restrict network access to the administrative interface to trusted hosts or management networks only, and place the service behind compensating controls such as firewall rules or a reverse proxy with strong access restrictions. Monitor for suspicious requests containing traversal sequences in the Admin-Token cookie or header.

Remediation

Patch, then assume compromise.

Upgrade to a fixed AdGuard Home release. The provided references indicate the issue was documented and likely addressed in AdGuard Home v0.107.77. Remediation should include correcting the authglinet middleware so that Admin-Token input is not used in filesystem path construction without strict validation and canonicalization, and ensuring token resolution cannot escape the intended directory.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.