Platform
linux
Component
pi-hole
Fixed in
6.0.1
CVE-2026-35519 is a Remote Code Execution (RCE) vulnerability discovered in the Pi-hole FTL (FTLDNS) DNS server. This flaw allows an authenticated attacker to inject malicious dnsmasq configuration directives, ultimately leading to command execution on the underlying system. The vulnerability affects versions 6.0.0 through 6.5.99 and has been resolved in version 6.6.0.
The impact of this vulnerability is severe. A successful exploit allows an attacker to execute arbitrary commands on the system hosting the Pi-hole FTL DNS server. This could lead to complete system compromise, including data theft, malware installation, and denial of service. The attacker would need to be authenticated to the Pi-hole web interface to exploit this vulnerability, but once authenticated, the impact is significant. This vulnerability shares similarities with other DNS configuration injection attacks, where improper sanitization of user-supplied input leads to unintended code execution.
CVE-2026-35519 was publicly disclosed on April 7, 2026. The vulnerability is not currently listed on the CISA KEV catalog, and its EPSS score is pending evaluation. No public proof-of-concept (PoC) exploits have been released at the time of writing, but the nature of the vulnerability suggests that it is likely to be exploited once a PoC becomes available.
Exploit Status
EPSS
0.23% (45% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-35519 is to upgrade Pi-hole FTL to version 6.6.0 or later. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider temporarily restricting access to the DNS host record configuration parameter (dns.hostRecord) through firewall rules or access control lists. Monitor Pi-hole logs for any unusual dnsmasq configuration directives being added. Review and audit existing DNS configurations for any suspicious entries. After upgrading, confirm the fix by verifying the version number of the FTL engine and attempting to inject a malicious dnsmasq directive through the web interface – it should be rejected.
Update Pi-hole FTL to version 6.6 or later to mitigate the remote code execution vulnerability. The update can be performed through the Pi-hole web interface or via the command line following the official documentation instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-35519 is a Remote Code Execution vulnerability in Pi-hole FTL, allowing authenticated attackers to execute commands on the server through DNS host record configuration.
You are affected if you are running Pi-hole FTL versions 6.0.0 through 6.5.99. Upgrade to 6.6.0 or later to mitigate the risk.
Upgrade Pi-hole FTL to version 6.6.0 or later. As a temporary workaround, restrict access to the dns.hostRecord configuration parameter.
No active exploitation has been confirmed at this time, but the vulnerability is considered likely to be exploited once a proof-of-concept is released.
Refer to the official Pi-hole security advisory on their website for the latest information and updates regarding CVE-2026-35519.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.