Pi-hole FTL CVE-2026-44693

Exploitation requires that the Pi-hole FTL embedded CivetWeb-based web admin interface (introduced in v6.0) be network-reachable by the attacker and that a legitimate administrator be concurrently authenticated and actively generating HTTP requests against it - the UI:R metric reflects this required admin interaction. The race window exists in the HTTP session management code path, so an attacker must be able to issue multiple overlapping HTTP requests timed against the admin's session activity; instances where the admin UI is bound to localhost only, firewalled to management subnets, or simply idle during the attack window are not practically exploitable. Versions prior to v6.0 (which used the older web stack) and v6.6.1 or later are not affected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H rates this 8.8 (High), reflecting network reachability, low attack complexity, no privileges required, but mandatory user interaction - typically meaning a legitimate admin must be actively using the web UI for the race to be winnable. EPSS and CISA KEV data were not provided in the input; absence is not confirmation either way, but no public exploit identified at time of analysis and the vulnerability was reported through a coordinated GitHub Security Advisory rather than after observed exploitation. Race-condition session bugs are notoriously timing-sensitive and reliability of exploitation in production environments tends to be far lower than the raw 8.8 score implies, so this is best treated as a meaningful but not emergency priority - patch within a normal maintenance window, prioritizing internet-exposed Pi-hole instances. The CVSS UI:R requirement and reliance on concurrent admin activity are the main mitigating factors against widespread automated exploitation.

An attacker on the same network as a Pi-hole instance - or able to reach an exposed admin interface - sends concurrent HTTP requests timed to coincide with an authenticated admin browsing the web UI, racing the session management code to either hijack the admin's session cookie state or assume their authenticated context. Once the race is won, the attacker can modify DNS blocklists, disable filtering, exfiltrate query logs revealing browsed domains, or pivot the Pi-hole into a DNS-based man-in-the-middle position. No public proof-of-concept is identified at time of analysis, and successful exploitation requires winning a timing window during real admin activity.