CVE-2026-50130
High
Description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPi-hole
PublishedJul 14, 2026
First seenJul 14, 2026
Weakness typeCWE-282CWE-282
How to fix
Update
- pi-hole pi-hole6.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pi-hole pi-hole | 6.0 ≤ v < 6.4.3 | 6.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.