What is the CVSS score of CVE-2026-35491?

CVE-2026-35491 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35491?

Yes, a patch is available for CVE-2026-35491. Update the affected software to the latest version immediately.

Pi Hole CVE-2026-35491

EUVD-2026-19676 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-07 GitHub_M

Authentication Bypass Pi Hole Ftl

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

6.6

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2026-19676

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 15:00 nvd

MEDIUM 6.1

DescriptionGitHub Advisory

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter imports for CLI sessions, enabling a CLI-scoped session to overwrite configuration via a Teleporter archive (authorization bypass). This vulnerability is fixed in 6.6.

AnalysisAI

Pi-hole FTL versions 6.0 through 6.5 allow authenticated local users with CLI API session privileges to bypass authorization controls and overwrite configuration settings via Teleporter archive imports. The vulnerability exists because the /api/teleporter endpoint incorrectly permits CLI-scoped sessions (intended to be read-only) to execute privileged Teleporter operations, while the /api/config endpoint correctly enforces restrictions. This authentication bypass is fixed in Pi-hole FTL 6.6.

Technical ContextAI

Pi-hole FTL is the DNS/DHCP server component of Pi-hole that provides both an interactive API and statistical data for the Web interface. The vulnerability stems from inconsistent authorization enforcement across API endpoints. The webserver.api.cli_pw configuration feature creates CLI-scoped API sessions that should be restricted to read-only operations for configuration queries. However, the /api/teleporter endpoint fails to validate session scope before processing Teleporter archive uploads, allowing CLI sessions to import configuration archives that modify system state. This is classified as CWE-863 (Incorrect Authorization), indicating that the authorization check was either missing or improperly implemented at the Teleporter endpoint. The affected product is identified by CPE cpe:2.3:a:pi-hole:ftl:*:*:*:*:*:*:*:* for all versions from 6.0 to 6.5.

RemediationAI

Upgrade Pi-hole FTL to version 6.6 or later, which includes proper authorization checks for the /api/teleporter endpoint. Users unable to immediately patch should restrict the assignment of CLI API credentials to trusted users only and monitor API access logs for unexpected Teleporter import requests. If webserver.api.cli_pw is not in active use, disabling the CLI password feature eliminates the attack surface. Consult the official security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-r7g8-3fj7-m5qq for detailed upgrade instructions and confirmation of patched versions.