CVE-2026-33727: Pi-hole Privilege Escalation Vulnerability

CVE-2026-33727 Overview

Pi-hole is a popular Linux network-level advertisement and Internet tracker blocking application widely deployed on home networks and small business environments. CVE-2026-33727 is a local privilege escalation vulnerability affecting Pi-hole version 6.4 that allows code execution as root from the low-privilege pihole account.

While the pihole account uses nologin, which prevents direct interactive login, this does not prevent code from running as UID pihole if a Pi-hole component is compromised. In a realistic post-compromise scenario, attacker-controlled content placed in /etc/pihole/versions is sourced by root-run Pi-hole scripts, leading to arbitrary root code execution.

Critical Impact

An attacker who has already compromised a Pi-hole component can escalate privileges from the low-privilege pihole account to root by injecting malicious content into configuration files that are sourced by root-privileged scripts.

Affected Products

• Pi-hole version 6.4
• Linux-based Pi-hole deployments using the standard service configuration
• Systems where Pi-hole scripts execute with root privileges

Discovery Timeline

• 2026-04-06 - CVE-2026-33727 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-33727

Vulnerability Analysis

This vulnerability falls under CWE-269 (Improper Privilege Management). The core issue stems from how Pi-hole handles configuration files and the trust relationship between user-writable configuration paths and root-executed scripts.

The vulnerability exists because Pi-hole scripts running with root privileges source content from /etc/pihole/versions without adequate validation. Since the low-privilege pihole user can write to this file, an attacker who has compromised any Pi-hole component can inject arbitrary shell commands that will subsequently be executed with root privileges.

The local attack vector requires the attacker to first gain access to the pihole user context, typically through exploitation of another vulnerability in a Pi-hole component or related service. Once this initial foothold is established, the privilege escalation can be achieved by manipulating the versions file.

Root Cause

The root cause is improper privilege management in how Pi-hole handles file sourcing operations. Specifically, the /etc/pihole/versions file is writable by the pihole user but is sourced (executed) by scripts running as root. This creates a privilege boundary violation where unprivileged content can influence privileged execution contexts.

The design flaw violates the principle of least privilege by allowing configuration files modified by a low-privilege service account to be consumed by root-level processes without proper sanitization or integrity verification.

Attack Vector

The attack requires local access and follows a post-compromise escalation pattern:

1. An attacker first compromises a Pi-hole component or gains execution as the pihole user
2. The attacker writes malicious shell commands to /etc/pihole/versions
3. When a root-privileged Pi-hole script sources this file during normal operations, the injected commands execute with root privileges
4. The attacker achieves full root access to the system

This vulnerability mechanism involves shell command injection through configuration file manipulation. An attacker with access to the pihole user context can modify /etc/pihole/versions to include malicious shell commands. When Pi-hole maintenance scripts running as root source this file, the injected commands execute with elevated privileges. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33727

Indicators of Compromise

• Unexpected modifications to /etc/pihole/versions file, particularly entries containing shell metacharacters or command syntax
• Unusual process spawning from Pi-hole scripts or the pihole user context
• New or modified files in system directories that should not be writable by the pihole user
• Evidence of privilege escalation attempts in system logs or audit trails

Detection Strategies

• Monitor file integrity of /etc/pihole/versions and other Pi-hole configuration files using tools like AIDE or Tripwire
• Implement auditd rules to track modifications to Pi-hole configuration directories
• Deploy endpoint detection solutions to identify unusual process trees originating from Pi-hole services
• Review system logs for suspicious shell command execution patterns associated with Pi-hole scripts

Monitoring Recommendations

• Enable comprehensive logging for all Pi-hole service activities
• Configure real-time alerting for modifications to critical Pi-hole configuration files
• Monitor for unusual network activity from the Pi-hole host that might indicate post-compromise activity
• Implement SentinelOne's behavioral AI to detect privilege escalation attempts and anomalous root process execution

How to Mitigate CVE-2026-33727

Immediate Actions Required

• Upgrade Pi-hole to version 6.4.1 or later immediately, as this version contains the security fix
• Audit current Pi-hole installations to verify the integrity of /etc/pihole/versions and related configuration files
• Review system logs for any evidence of exploitation or unauthorized modifications
• Consider temporarily restricting network access to Pi-hole management interfaces until patching is complete

Patch Information

Pi-hole has released version 6.4.1 which addresses this vulnerability. The fix prevents the privilege escalation by properly securing how configuration files are handled by root-privileged scripts.

Administrators should update their Pi-hole installations using the standard update mechanism:

pihole -up

For more details about this vulnerability and the fix, refer to the GitHub Security Advisory.

Workarounds

• Restrict write permissions on /etc/pihole/versions to root only as a temporary measure: chmod 644 /etc/pihole/versions && chown root:root /etc/pihole/versions
• Implement file integrity monitoring to detect unauthorized modifications to Pi-hole configuration files
• Consider network segmentation to limit exposure of Pi-hole systems while waiting for patch deployment
• Deploy additional access controls to restrict who can execute commands as the pihole user

# Temporary mitigation: Secure the versions file permissions
sudo chown root:root /etc/pihole/versions
sudo chmod 644 /etc/pihole/versions

# Verify file integrity
sudo sha256sum /etc/pihole/versions

# Check for suspicious content in the versions file
sudo cat /etc/pihole/versions | grep -E '[$`;&|]'