CVE-2026-35519: RCE in Pi-hole FTL DNS Server
Platform
linux
Component
pi-hole
Fixed in
6.0.1
CVE-2026-35519 is a Remote Code Execution (RCE) vulnerability discovered in the Pi-hole FTL (FTLDNS) DNS server. This flaw allows an authenticated attacker to inject malicious dnsmasq configuration directives, ultimately leading to command execution on the underlying system. The vulnerability affects versions 6.0.0 through 6.5.99 and has been resolved in version 6.6.0.
Impact and Attack Scenarios
The impact of this vulnerability is severe. A successful exploit allows an attacker to execute arbitrary commands on the system hosting the Pi-hole FTL DNS server. This could lead to complete system compromise, including data theft, malware installation, and denial of service. The attacker would need to be authenticated to the Pi-hole web interface to exploit this vulnerability, but once authenticated, the impact is significant. This vulnerability shares similarities with other DNS configuration injection attacks, where improper sanitization of user-supplied input leads to unintended code execution.
Exploitation Context
CVE-2026-35519 was publicly disclosed on April 7, 2026. The vulnerability is not currently listed on the CISA KEV catalog, and its EPSS score is pending evaluation. No public proof-of-concept (PoC) exploits have been released at the time of writing, but the nature of the vulnerability suggests that it is likely to be exploited once a PoC becomes available.
Threat Intelligence
Exploit Status
EPSS
0.23% (45% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- High — attacker can write, modify, or delete any data: databases, config files, or code.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-35519 is to upgrade Pi-hole FTL to version 6.6.0 or later. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider temporarily restricting access to the DNS host record configuration parameter (dns.hostRecord) through firewall rules or access control lists. Monitor Pi-hole logs for any unusual dnsmasq configuration directives being added. Review and audit existing DNS configurations for any suspicious entries. After upgrading, confirm the fix by verifying the version number of the FTL engine and attempting to inject a malicious dnsmasq directive through the web interface – it should be rejected.
How to fix
Update Pi-hole FTL to version 6.6 or later to mitigate the remote code execution vulnerability. The update can be performed through the Pi-hole web interface or via the command line following the official documentation instructions.
CVE Security Newsletter
Vulnerability analysis and critical alerts directly to your inbox.
Frequently asked questions
What is CVE-2026-35519 — RCE in Pi-hole FTL?
CVE-2026-35519 is a Remote Code Execution vulnerability in Pi-hole FTL, allowing authenticated attackers to execute commands on the server through DNS host record configuration.
Am I affected by CVE-2026-35519 in Pi-hole FTL?
You are affected if you are running Pi-hole FTL versions 6.0.0 through 6.5.99. Upgrade to 6.6.0 or later to mitigate the risk.
How do I fix CVE-2026-35519 in Pi-hole FTL?
Upgrade Pi-hole FTL to version 6.6.0 or later. As a temporary workaround, restrict access to the dns.hostRecord configuration parameter.
Is CVE-2026-35519 being actively exploited?
No active exploitation has been confirmed at this time, but the vulnerability is considered likely to be exploited once a proof-of-concept is released.
Where can I find the official Pi-hole advisory for CVE-2026-35519?
Refer to the official Pi-hole security advisory on their website for the latest information and updates regarding CVE-2026-35519.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.