Skip to content
Local Privilege Escalation Vulnerabilities in Pi-hole Disclosed

Local Privilege Escalation Vulnerabilities in Pi-hole Disclosed

First seen 20 Oct 2026, 12:50 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 14:20 UTC
  • •Pi-hole vulnerabilities allow local privilege escalation to root.
  • •Unprivileged users can exploit symlink manipulation in cron jobs.
  • •Ambient CAP_CHOWN capabilities in pihole-FTL enable file ownership attacks.

Two vulnerabilities affecting Pi-hole have been disclosed. The first allows an unprivileged user to manipulate root-owned files via a symlink in the updatechecker cron job, enabling arbitrary file truncation and permission changes. The second vulnerability involves the pihole-FTL service, which runs with ambient CAP_CHOWN capabilities, allowing it to escalate privileges to root through file ownership manipulation. Both vulnerabilities were introduced in recent updates, with the first being linked to version 6.4.2. Attackers can exploit these flaws to gain root access on affected systems. No patches have been reported as of the publication date. Users are advised to monitor for updates and restrict access to the Pi-hole service.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Vulnerabilities disclosed
Two vulnerabilities affecting Pi-hole were disclosed, allowing local privilege escalation through symlink manipulation and ambient capabilities.
Article 1
2026-10-20
Security advisory published
GitHub published advisories for the vulnerabilities, detailing the attack vectors and implications for users.
Article 2

More articles in this cluster (2)

Extracted Entities (8)

1 / 4

Common questions

What versions of Pi-hole are affected?
The vulnerabilities affect recent versions of Pi-hole, particularly those updated to version 6.4.2.
Are these vulnerabilities being actively exploited?
The articles do not confirm any active exploitation at this time.
What should I do to protect my system?
Monitor for updates from Pi-hole and restrict access to the service until a patch is released.