9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32136

CVE-2026-32136: AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32136

CVE-2026-32136:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/AdguardTeam/AdGuardHome	go	< 0.107.73	0.107.73

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass caused by the incorrect ordering of HTTP middleware in AdGuard Home's web server initialization. The analysis of the provided security advisory and the associated patch commit c003e9f9c04311a13ca7a873a8437f80711102a5 confirms this. The vulnerable function is webAPI.start in internal/home/web.go. In the vulnerable version, the authentication middleware was applied outside the h2c.NewHandler. This meant that while the initial HTTP/1.1 upgrade request was handled correctly (as it targeted a public, non-authenticated endpoint like /control/login), the subsequent HTTP/2 connection established by the h2c library used an inner handler that completely lacked the authentication middleware. The patch rectifies this by wrapping the base handler with authentication first, and then passing the fully-secured handler to h2c.NewHandler. This ensures that all requests on the connection, pre- and post-upgrade, are properly authenticated. Therefore, the webAPI.start function is the single point of failure where the vulnerable server configuration was created.

Vulnerable functions

webAPI.start

internal/home/web.go

The `start` function in `webAPI` incorrectly configured the HTTP server. It wrapped the `h2c` (HTTP/2 Cleartext) handler with authentication middleware, instead of applying the middleware to the handler *before* it was passed to `h2c.NewHandler`. This architectural flaw allowed an attacker to send a standard HTTP/1.1 request to a public endpoint, request an upgrade to `h2c`, and the resulting HTTP/2 connection would not be subject to authentication checks. The inner handler used by `h2c` after the protocol switch did not have the authentication middleware applied, granting the attacker full administrative access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.