Read the docs
TI-2026-27637 Aliases CVE-2026-35520

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

Priority HIGH 73CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00713 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed FTL (pi-hole): 6.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Pi-holeFTL6.0 to before 6.66.6Patch availableCNA
  • FTL VendorPi-hole Affected 6.0 to before 6.6 Fixed in 6.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:*6.0 – 6.5VulnerablePi-hole
  • cpe:2.3:a:pi-hole:ftldns:*:*:*:*:*:*:*:* Versions 6.0 – 6.5 Vulnerable ·Pi-hole

Remediation

  • Fix · CNA FTL (pi-hole) Fixed in 6.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35520

References

Exploit 1

  • TI-2026-28731 Pi-hole FTL remote code execution via newline injection in dns.interface configuration CVSS 4.0HIGH 8.7
  • TI-2026-27638 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection CVSS 3.1HIGH 8.8
  • TI-2026-27636 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection CVSS 3.1HIGH 8.8
  • TI-2026-27635 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection CVSS 3.1HIGH 8.8
  • TI-2026-27634 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection CVSS 3.1HIGH 8.8
  • TI-2026-27620 Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences