What’s Vulnerable › Products

pi-hole FTL vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your pi-hole FTL version is affected

Latest pi-hole FTL vulnerabilities

• CVE-2026-44693 — Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer (CVSS 8.8)
• CVE-2026-39849 — Pi-hole FTL remote code execution via newline injection in dns.interface configuration (CVSS 8.8)
• CVE-2026-35521 — Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection (CVSS 8.8)
• CVE-2026-35520 — Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection (CVSS 8.8)
• CVE-2026-35519 — Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection (CVSS 8.8)
• CVE-2026-35518 — Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection (CVSS 8.8)
• CVE-2026-35517 — Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection (CVSS 8.8)
• CVE-2026-35491 — Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration (CVSS 6.1)
• CVE-2021-29448 — Stored DOM XSS in Pi-hole Admin Web Interface (CVSS 8.8)