CVE-2026-44693

HighCVSS 8.8

Published: 10/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Pi-hole FTL before version 6.6.1 contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

Risk Assessment

The risk is potential unauthorized access to HTTP sessions, which could lead to admin session hijacking and compromise of the entire Pi-hole system.

Recommendation

Immediately update Pi-hole FTL to version 6.6.1 or later, which contains the fix.

Other vulnerabilities in Pi-hole FTL

CVE-2026-39849High
In Pi-hole FTL before version 6.6.1, the `dns.interface` configuration field accepts newline characters without validation, allowing an attacker to inject directives into the dnsmasq config file. On installations without an admin password, a network-adjacent attacker can enable the built-in DHCP server and achieve remote code execution on the next DHCP lease request. Fixed in version 6.6.1.

Original NVD description (English source)

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.