Ftl CVE-2026-35517

Authenticated attacker with access to Pi-hole FTL API versions 6.0-6.5. Attacker must modify the dns.upstreams configuration parameter by injecting newline characters with dnsmasq directives to achieve command execution on the underlying system.

This vulnerability presents a significant risk to Pi-hole deployments despite requiring authenticated access. The CVSS score of 8.8 (High) reflects network-based attack vector (AV:N), low complexity (AC:L), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). However, the low-privilege authentication requirement (PR:L) substantially reduces real-world exploitability compared to unauthenticated RCE. The vulnerability requires an attacker to first compromise valid Pi-hole administrative credentials or exploit another authentication bypass. No confirmed active exploitation (not listed in CISA KEV) and no weaponized public exploit code has been identified, suggesting threat actors have not yet operationalized this attack path. The technical impact is severe-full system compromise-but the prerequisite of credential access limits mass exploitation scenarios. Organizations should prioritize this based on their Pi-hole exposure: internet-facing Pi-hole admin interfaces represent critical risk, while LAN-only deployments with strong credential hygiene face moderate risk. The availability of a vendor patch (version 6.6) and relatively narrow affected version range (6.0-6.5) make remediation straightforward for most deployments.

An attacker who has obtained valid Pi-hole administrative credentials (through phishing, credential stuffing, or exploiting weak default passwords) authenticates to the Pi-hole web interface or API endpoint from a remote network location. The attacker navigates to the upstream DNS server configuration section and injects a malicious payload into the dns.upstreams parameter containing embedded newline characters followed by dnsmasq directives such as 'dhcp-script=/tmp/malicious.sh'. When FTL processes this configuration and regenerates the dnsmasq configuration file, the injected directive is written and activated. Upon the next DHCP event or DNS query triggering the injected hook, dnsmasq executes the attacker's script with the privileges of the FTL/dnsmasq process (typically root on Pi-hole systems), granting complete system compromise. The attacker can then establish persistence, exfiltrate DNS query data, pivot to other network systems, or use the compromised Pi-hole as a command-and-control node within the network.