Skip to main content
Mallory
Critical

Authentication bypass in AdGuard Home --glinet mode via Admin-Token path traversal

IdentifiersCVE-2026-41448CWE-22· Improper Limitation of a Pathname…

CVE-2026-41448 is an authentication bypass vulnerability in AdGuard Home that is exposed when the product is started with the --glinet flag. The flaw resides in the authglinet middleware, where the value supplied in the Admin-Token cookie or header is incorporated into the token file path using unsanitized string concatenation. By supplying path traversal sequences in the Admin-Token value, an unauthenticated attacker can cause the application to resolve and read from unintended filesystem paths instead of the expected token file location. This path manipulation can be used to satisfy the GL.iNet-specific authentication logic and bypass normal authentication controls, resulting in full administrative access.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication and obtain full administrator access to the affected AdGuard Home instance. The provided CVSS vectors indicate high confidentiality and integrity impact and low availability impact. In practical terms, an attacker who gains admin access can fully control the AdGuard Home configuration and management interface, access sensitive configuration data, and make unauthorized changes to service behavior.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, avoid running AdGuard Home with the --glinet flag unless it is strictly required. Restrict network exposure of the administrative interface to trusted management networks, place the service behind access controls such as VPN or reverse-proxy authentication, and monitor for suspicious requests carrying traversal sequences in the Admin-Token cookie or header. Additional hardening should include limiting filesystem access available to the service process to reduce the impact of arbitrary path resolution.

Remediation

Patch, then assume compromise.

Upgrade AdGuard Home to a version that includes the fix referenced by the vendor materials, with the available context indicating AdGuard Home v0.107.77 as the relevant release. The underlying issue should be remediated by preventing path traversal in Admin-Token handling, including strict validation/canonicalization of token input and avoiding unsafe string concatenation when constructing filesystem paths in the authglinet middleware.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.