Vulnerability Details CVE-2026-50130
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 5.3%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-50130
-
cpe:2.3:a:pi-hole:pi-hole:6.0
-
cpe:2.3:a:pi-hole:pi-hole:6.0.1
-
cpe:2.3:a:pi-hole:pi-hole:6.0.3
-
cpe:2.3:a:pi-hole:pi-hole:6.0.4
-
cpe:2.3:a:pi-hole:pi-hole:6.0.5
-
cpe:2.3:a:pi-hole:pi-hole:6.0.6
-
cpe:2.3:a:pi-hole:pi-hole:6.1
-
cpe:2.3:a:pi-hole:pi-hole:6.1.1
-
cpe:2.3:a:pi-hole:pi-hole:6.1.2
-
cpe:2.3:a:pi-hole:pi-hole:6.1.3
-
cpe:2.3:a:pi-hole:pi-hole:6.1.4
-
cpe:2.3:a:pi-hole:pi-hole:6.2
-
cpe:2.3:a:pi-hole:pi-hole:6.2.1
-
cpe:2.3:a:pi-hole:pi-hole:6.2.2
-
cpe:2.3:a:pi-hole:pi-hole:6.3
-
cpe:2.3:a:pi-hole:pi-hole:6.4
-
cpe:2.3:a:pi-hole:pi-hole:6.4.1
-
cpe:2.3:a:pi-hole:pi-hole:6.4.2