CVE-2026-41448

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41448
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41448.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41448
Published
2026-06-08T16:12:56.518Z
Modified
2026-07-08T08:13:13.064583982Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie
Details

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41448.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/adguardteam/adguardhome

Affected ranges

Type
GIT
Repo
https://github.com/adguardteam/adguardhome
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
09789cd5d2d68563143a3a66160dc3ecb3cfba40
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.107.77"
        }
    ]
}

Affected versions

v0.*
v0.1
v0.100.0
v0.100.1
v0.100.2
v0.100.3
v0.100.4
v0.100.5
v0.100.6
v0.100.7
v0.100.8
v0.100.9
v0.101.0
v0.102.0
v0.103.0
v0.103.0-beta1
v0.103.0-beta2
v0.103.0-beta3
v0.103.1
v0.103.2
v0.103.3
v0.104.0
v0.104.0-beta1
v0.104.0-beta2
v0.104.0-beta3
v0.104.1
v0.105.0
v0.105.0-beta.3
v0.105.0-beta.4
v0.105.0-beta.5
v0.105.1
v0.105.1-beta.1
v0.105.2
v0.105.2-beta.1
v0.106.0
v0.106.0-b.1
v0.106.0-b.2
v0.106.0-b.3
v0.106.0-b.4
v0.106.0-b.5
v0.107.0
v0.107.0-b.1
v0.107.0-b.10
v0.107.0-b.11
v0.107.0-b.12
v0.107.0-b.13
v0.107.0-b.14
v0.107.0-b.15
v0.107.0-b.16
v0.107.0-b.17
v0.107.0-b.2
v0.107.0-b.3
v0.107.0-b.4
v0.107.0-b.5
v0.107.0-b.6
v0.107.0-b.7
v0.107.0-b.8
v0.107.0-b.9
v0.107.1
v0.107.10
v0.107.11
v0.107.12
v0.107.13
v0.107.14
v0.107.15
v0.107.16
v0.107.17
v0.107.18
v0.107.19
v0.107.2
v0.107.20
v0.107.21
v0.107.22
v0.107.23
v0.107.24
v0.107.25
v0.107.26
v0.107.27
v0.107.28
v0.107.29
v0.107.3
v0.107.30
v0.107.31
v0.107.32
v0.107.33
v0.107.34
v0.107.35
v0.107.36
v0.107.37
v0.107.38
v0.107.39
v0.107.4
v0.107.40
v0.107.41
v0.107.42
v0.107.43
v0.107.44
v0.107.45
v0.107.46
v0.107.47
v0.107.48
v0.107.49
v0.107.5
v0.107.50
v0.107.51
v0.107.52
v0.107.53
v0.107.54
v0.107.55
v0.107.56
v0.107.57
v0.107.58
v0.107.59
v0.107.6
v0.107.60
v0.107.61
v0.107.62
v0.107.63
v0.107.64
v0.107.65
v0.107.66
v0.107.67
v0.107.68
v0.107.69
v0.107.7
v0.107.70
v0.107.71
v0.107.72
v0.107.73
v0.107.74
v0.107.75
v0.107.76
v0.107.8
v0.107.9
v0.9
v0.9-hotfix1
v0.91
v0.92
v0.92-hotfix1
v0.92-hotfix2
v0.93
v0.95
v0.95-hotfix
v0.96
v0.96-hotfix
v0.97.0
v0.97.1
v0.98.0
v0.98.1
v0.99.0
v0.99.1
v0.99.2
v0.99.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41448.json"