AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass
Date: 2026-03
Affected: go/github.com/AdguardTeam/AdGuardHome
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-32136
CWE: CWE-287
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

VULNERABILITY: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass ======================================================================== Severity: CRITICAL CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE: CWE-287 (Improper Authentication) Component: internal/home/web.go Affected: AdGuardHome (tested on v0.107.72) ------------------------------------------------------------------------ Summary ------------------------------------------------------------------------ An unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. ------------------------------------------------------------------------ Root Cause ------------------------------------------------------------------------ In internal/home/web.go (approximately lines 268-283), the HTTP server is constructed as follows: hdlr := h2c.NewHandler( withMiddlewares(web.conf.mux, limitRequestBody), // no auth &http2.Server{}, ) web.httpServer = &http.Server{ Handler: web.auth.middleware().Wrap(hdlr), // auth here } The authentication middleware wraps the h2c handler at the outer l


Mitigations:

Architectural layers (MAESTRO):