CVE-2026-50130: Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-14 · updated 2026-07-30
Weakness: CWE-282

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

Affected products

pi-hole: from 6.0 before 6.4.3 — fixed in 6.4.3

How to fix

Upgrade to a fixed version: pi-hole 6.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-50130 or the next vulnerability affects your stack