CVE-2026-35491
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Pi-hole FTL (FTLDNS) from 6.0 to before 6.6, CLI sessions intended to be read-only could import Teleporter archives via /api/teleporter and overwrite configuration. This is an authorization bypass, fixed in 6.6.
Risk Assessment
A low-privileged CLI session could alter Pi-hole configuration, potentially leading to unauthorized changes to DNS and security settings.
Recommendation
Update Pi-hole FTL to version 6.6 or later.
Other vulnerabilities in Pi-hole FTL
See all- CVE-2026-44693High
Pi-hole FTL before version 6.6.1 contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.
- CVE-2026-39849High
In Pi-hole FTL before version 6.6.1, the `dns.interface` configuration field accepts newline characters without validation, allowing an attacker to inject directives into the dnsmasq config file. On installations without an admin password, a network-adjacent attacker can enable the built-in DHCP server and achieve remote code execution on the next DHCP lease request. Fixed in version 6.6.1.
Original NVD description (English source)
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter imports for CLI sessions, enabling a CLI-scoped session to overwrite configuration via a Teleporter archive (authorization bypass). This vulnerability is fixed in 6.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS