Which versions of Adguardhome are affected by EUVD-2026-35126?

AdGuard Home versions prior to 0.107.77 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to gain full administrative access when deployed with the --glinet…. A patch is available.

How to fix or mitigate EUVD-2026-35126?

Within 24 hours: Query all network infrastructure and security appliances to identify instances of AdGuard Home running with the --glinet flag. Within 7 days: Disable --glinet flag if operationally feasible, or implement strict firewall rules restricting admin interface access to authorized networks only. Within 30 days: Monitor vendor announcements for patch release targeting v0.107.77 or later; evaluate alternative DNS filtering solutions if patch timeline becomes extended.

Adguardhome EUVD-2026-35126

Q: What is the CVSS score of EUVD-2026-35126?

EUVD-2026-35126 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-41448 CRITICAL

Path Traversal (CWE-22)

2026-06-08 VulnCheck

GHSA-599m-gqxc-4x5m

Authentication Bypass Path Traversal Adguardhome

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 08, 2026 - 18:01 EUVD

Analysis Updated

Jun 08, 2026 - 17:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 08, 2026 - 17:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 08, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 08, 2026 - 17:22 NVD

9.4 (CRITICAL) 9.2 (CRITICAL)

Source Code Evidence Fetched

Jun 08, 2026 - 17:20 vuln.today

Analysis Generated

Jun 08, 2026 - 17:20 vuln.today

DescriptionCVE.org

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.

AnalysisAI

Authentication bypass in AdGuard Home prior to v0.107.77 allows unauthenticated remote attackers to gain full admin access when the binary is launched with the --glinet flag, by injecting a path traversal sequence into the Admin-Token cookie. The flaw lives in the authglinet middleware, which concatenates the cookie value into a file path without sanitization, letting attackers redirect token reads to arbitrary files. No public exploit identified at time of analysis, but the vendor advisory and a community-disclosed root cause make weaponization straightforward.