Plateforme
linux
Composant
pi-hole
Corrigé dans
6.0.1
CVE-2026-35519 is a Remote Code Execution (RCE) vulnerability discovered in the Pi-hole FTL (FTLDNS) DNS server. This flaw allows an authenticated attacker to inject malicious dnsmasq configuration directives, ultimately leading to command execution on the underlying system. The vulnerability affects versions 6.0.0 through 6.5.99 and has been resolved in version 6.6.0.
The impact of this vulnerability is severe. A successful exploit allows an attacker to execute arbitrary commands on the system hosting the Pi-hole FTL DNS server. This could lead to complete system compromise, including data theft, malware installation, and denial of service. The attacker would need to be authenticated to the Pi-hole web interface to exploit this vulnerability, but once authenticated, the impact is significant. This vulnerability shares similarities with other DNS configuration injection attacks, where improper sanitization of user-supplied input leads to unintended code execution.
CVE-2026-35519 was publicly disclosed on April 7, 2026. The vulnerability is not currently listed on the CISA KEV catalog, and its EPSS score is pending evaluation. No public proof-of-concept (PoC) exploits have been released at the time of writing, but the nature of the vulnerability suggests that it is likely to be exploited once a PoC becomes available.
Organizations and individuals running Pi-hole with versions 6.0.0 through 6.5.99 are at risk. This includes home users, small businesses, and larger organizations utilizing Pi-hole for ad blocking and DNS filtering. Shared hosting environments where Pi-hole is installed are particularly vulnerable, as they may have limited control over system configurations.
• linux / server:
journalctl -u pihole-FTL -g 'dnsmasq configuration'• linux / server:
ps aux | grep -i 'dnsmasq' | grep -i 'hostRecord'• linux / server:
cat /etc/pihole/dnsmasq.d/* | grep -i 'hostRecord'disclosure
Statut de l'Exploit
EPSS
0.23% (percentile 45%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2026-35519 is to upgrade Pi-hole FTL to version 6.6.0 or later. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider temporarily restricting access to the DNS host record configuration parameter (dns.hostRecord) through firewall rules or access control lists. Monitor Pi-hole logs for any unusual dnsmasq configuration directives being added. Review and audit existing DNS configurations for any suspicious entries. After upgrading, confirm the fix by verifying the version number of the FTL engine and attempting to inject a malicious dnsmasq directive through the web interface – it should be rejected.
Actualice Pi-hole FTL a la versión 6.6 o posterior para mitigar la vulnerabilidad de ejecución remota de código. La actualización se puede realizar a través de la interfaz web de Pi-hole o mediante la línea de comandos siguiendo las instrucciones de documentación oficial.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2026-35519 is a Remote Code Execution vulnerability in Pi-hole FTL, allowing authenticated attackers to execute commands on the server through DNS host record configuration.
You are affected if you are running Pi-hole FTL versions 6.0.0 through 6.5.99. Upgrade to 6.6.0 or later to mitigate the risk.
Upgrade Pi-hole FTL to version 6.6.0 or later. As a temporary workaround, restrict access to the dns.hostRecord configuration parameter.
No active exploitation has been confirmed at this time, but the vulnerability is considered likely to be exploited once a proof-of-concept is released.
Refer to the official Pi-hole security advisory on their website for the latest information and updates regarding CVE-2026-35519.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.