CVE-2026-44693
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Pi-hole FTL before version 6.6.1 contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.
Risk Assessment
The risk is potential unauthorized access to HTTP sessions, which could lead to admin session hijacking and compromise of the entire Pi-hole system.
Recommendation
Immediately update Pi-hole FTL to version 6.6.1 or later, which contains the fix.
Other vulnerabilities in Pi-hole FTL
See all- CVE-2026-39849High
In Pi-hole FTL before version 6.6.1, the `dns.interface` configuration field accepts newline characters without validation, allowing an attacker to inject directives into the dnsmasq config file. On installations without an admin password, a network-adjacent attacker can enable the built-in DHCP server and achieve remote code execution on the next DHCP lease request. Fixed in version 6.6.1.
- CVE-2026-35491Medium
In Pi-hole FTL (FTLDNS) from 6.0 to before 6.6, CLI sessions intended to be read-only could import Teleporter archives via /api/teleporter and overwrite configuration. This is an authorization bypass, fixed in 6.6.
Original NVD description (English source)
Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS