What is the CVSS score of CVE-2026-44693?

CVE-2026-44693 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pi-hole FTL are affected by CVE-2026-44693?

A high-severity vulnerability in Pi-hole FTL versions prior to 6.6.1 allows remote attackers to hijack administrator sessions and compromise DNS filtering controls; no public exploit code has been…

How to fix or mitigate CVE-2026-44693?

Within 24 hours: Inventory all Pi-hole FTL instances and versions; implement network access restrictions to administrative interfaces. Within 7 days: Upgrade all instances to Pi-hole FTL v6.6.1 or later and verify deployment. Within 30 days: Conduct forensic review of administrative access logs and DNS query logs for unauthorized access or traffic anomalies during the vulnerability window.

Pi-hole FTL CVE-2026-44693

HIGH

Race Condition (CWE-362)

2026-06-10 GitHub_M

Information Disclosure Race Condition Pi Hole Ftl

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable admin UI (AV:N), no auth needed by attacker (PR:N), but UI:R for concurrent admin activity and AC:H since race-window timing is non-trivial; full session compromise yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 22:53 vuln.today

Analysis Generated

Jun 10, 2026 - 22:53 vuln.today

DescriptionCVE.org

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

AnalysisAI

Session hijacking in Pi-hole FTL versions prior to 6.6.1 stems from a race condition in the CivetWeb-based HTTP session management subsystem introduced during the v6.0 rewrite. Remote attackers can leverage concurrent requests to compromise web admin session state, potentially gaining high-impact access (C:H/I:H/A:H per CVSS 8.8) to the DNS sinkhole and network filtering controls. No public exploit identified at time of analysis, but vendor has published an upstream fix in v6.6.1.

Technical ContextAI

Pi-hole FTL (Faster Than Light) is the C-based daemon at the heart of Pi-hole, handling DNS resolution, query logging, and the embedded administrative web interface. Since version 6.0, the project replaced its prior web stack with CivetWeb, an embedded HTTP server library, and the HTTP session management code introduced in that rewrite contains a CWE-362 concurrent-execution race condition. Race conditions in session subsystems typically arise from unsynchronized access to session token tables, cookie-to-session mappings, or per-session state structures, where two concurrent requests can interleave reads and writes such that one client observes or hijacks another's session context. The v6.6.1 release notes corroborate this, citing PR #2835 'thread-safety issues causing SIGSEGV under concurrent API load,' PR #2833 'rare race condition for SHM strings in API handlers,' and PR #2847 'thread-safety for concurrent API requests,' indicating broader concurrency hardening around the API surface.

RemediationAI

Vendor-released patch: upgrade Pi-hole FTL to version 6.6.1 or later, available at https://github.com/pi-hole/FTL/releases/tag/v6.6.1, with full advisory details at https://github.com/pi-hole/FTL/security/advisories/GHSA-9ff5-f3v5-2xc7. Until the upgrade is applied, restrict access to the Pi-hole web admin interface (default TCP/80 and /admin path) to trusted management networks via firewall rules or by binding the embedded web server to localhost only, accepting that this disables remote administration; additionally, avoid keeping multiple concurrent admin browser sessions open simultaneously, since the race requires overlapping HTTP session activity, though this is operationally inconvenient rather than a hard fix. Do not rely on disabling the API while leaving the web UI exposed, as the underlying CivetWeb session subsystem is shared.