CVE-2026-32136 | AdGuard Home is a network-wide software for blocking ads and… | CVSS 9.8 CRITICAL

Description

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.

Metadata

CVE ID: CVE-2026-32136
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-03-10 22:19 UTC
Published: 2026-03-11 21:42 UTC
Last updated: 2026-03-12 16:17 UTC
Primary CWE: CWE-287
CWE-287: Improper Authentication
Vendor / Product: AdguardTeam / AdGuardHome
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
AdguardTeam	AdGuardHome	—	< 0.107.73

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	CWE-287: Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://github.com/AdguardTeam/AdGuardHome/security/advisories/GHSA-5fg6-wrq4-w5gh https://github.com/AdguardTeam/AdGuardHome/security/advisories/GHSA-5fg6-wrq4-w5gh