Pi-hole CVE-2026-50130

Requires the attacker to already have code execution as the unprivileged pihole service account on the host (PR:L, AV:L) and the ability to write /etc/pihole/logrotate. Exploitation specifically depends on the vulnerable file location and Pi-hole's own automation: pihole-FTL-prestart.sh must run and chown the replaced file to root:root, and the daily pihole flush cron (or @reboot logrotate) must then parse it as root - so the attacker must wait for one of those root-triggered events. Limiting factors: it only affects Pi-hole 6.0.0-6.4.2 (fixed in 6.4.3), needs a pre-existing foothold as the pihole user (no remote or unauthenticated path), is not automatable per SSVC, and the payload runs only when the scheduled root job fires rather than on demand.

This is a genuine and clean privilege-escalation primitive but with a deliberately narrow starting point. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C, 8.8) correctly reflects that an attacker must already hold local, low-privileged (pihole user) code execution, which is a meaningful precondition rather than a network-facing entry point. SSVC agrees: exploitation=poc (not active), automatable=no (needs an existing foothold and waits on a cron/reboot trigger), technical impact=total (full root). EPSS is low at 0.22% / 13th percentile, and there is no CISA KEV listing, so mass or opportunistic exploitation is unlikely - this is a reliable second-stage escalation, not a remote 0-day. The signals are internally consistent: high impact, high reliability, but gated behind a prerequisite compromise, so real-world priority is high specifically for hosts where the pihole account could be reached (e.g. via a separate web/FTL RCE) and lower where that foothold is implausible. The RCE tag refers to the root code execution achieved via the config parse, not to unauthenticated remote access.

An attacker who has gained code execution as the pihole user - for example through a separate flaw in the web interface or FTL - writes a malicious /etc/pihole/logrotate that includes a firstaction block containing a shell payload (such as adding a root SSH key or a setuid backdoor). They then wait for the next daily flush cron or a system reboot, at which point pihole-FTL-prestart.sh chowns the file to root and logrotate executes the firstaction as uid 0, granting full root. A proof-of-concept is indicated by the SSVC 'poc' status.