CVE-2026-41448 is a critical path traversal vulnerability in AdGuardHome when launched with the --glinet flag. The vulnerability exists due to improper sanitization of the Admin-Token cookie, which is used in file path construction within the authglinet middleware. By supplying a crafted path traversal sequence in the Admin-Token header, an unauthenticated attacker can bypass authentication and gain full administrative access by redirecting file reads to arbitrary filesystem locations. This vulnerability has a CVSS 4.0 score of 9.2, reflecting its high impact and ease of exploitation without privileges or user interaction.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain full administrative access to AdGuardHome instances running with the --glinet flag. This could lead to complete compromise of the affected system's configuration and potentially sensitive data accessible via the administrative interface. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid running AdGuardHome with the --glinet flag or restrict access to the administrative interface to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.