CVE-2026-32136: Authentication Bypass in AdGuard Home

The impact of this vulnerability is severe. Successful exploitation allows an attacker to bypass authentication and gain unauthorized access to the AdGuard Home management interface. This could lead to complete control over the ad blocking configuration, potentially allowing the attacker to inject malicious advertisements, redirect users to phishing sites, or even compromise the underlying network. Given AdGuard Home's network-wide scope, the blast radius extends to all devices using the affected instance, making it a significant security risk. The ease of exploitation via h2c further amplifies the potential for widespread abuse.

1. Reserved2026-03-10
2. Published2026-03-12
3. Modified2026-03-23
4. EPSS updated2026-03-23

The primary mitigation is to upgrade AdGuard Home to version 0.107.73 or later, which contains the fix. If an immediate upgrade is not possible due to compatibility issues or downtime constraints, consider temporarily disabling HTTP/2 Cleartext Upgrade (h2c) by configuring your reverse proxy (e.g., Nginx, Apache) to block h2c connections to AdGuard Home. This will prevent exploitation but may impact performance. Monitor AdGuard Home logs for any suspicious activity, particularly related to authentication attempts. After upgrading, confirm the fix by attempting an authentication bypass via h2c and verifying that it is unsuccessful.