CVE-2026-39849: Pi-hole FTL RCE Vulnerability

CVE-2026-39849 Overview

CVE-2026-39849 is a CRLF/newline injection vulnerability [CWE-93] in Pi-hole FTL, the core engine of the Pi-hole network-level advertisement and tracker blocker. The dns.interface configuration field accepts newline characters without validation, allowing an attacker to inject arbitrary directives into the generated dnsmasq configuration file. On installations with no admin password set, which is the default for many deployments, the configuration API is fully accessible without credentials. A network-adjacent attacker can inject a payload, enable the built-in DHCP server, and achieve arbitrary command execution on the host the next time any device requests a DHCP lease. The issue is fixed in version 6.6.1.

Critical Impact

A network-adjacent attacker can achieve arbitrary command execution on Pi-hole FTL hosts running default configurations without authentication, with the malicious directives persisting across restarts.

Affected Products

• Pi-hole FTL versions before 6.6.1
• Pi-hole deployments with no admin password configured (default)
• Pi-hole installations exposing the configuration API to local network clients

Discovery Timeline

• 2026-05-05 - CVE-2026-39849 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-39849

Vulnerability Analysis

The vulnerability stems from improper neutralization of CRLF sequences [CWE-93] in the dns.interface configuration field. Pi-hole FTL persists this field to /etc/pihole/pihole.toml and renders it into a dnsmasq configuration file. Because newline characters are accepted unchanged, an attacker can append arbitrary dnsmasq directives by submitting a value like wlan0\ndhcp-script=/tmp/p. The strncpy in the code path limits the interface field to 31 bytes, but the example payload fits within that constraint. The dnsmasq configuration validation introduced in FTL 6.6 only checks syntactic validity, so injected directives pass validation successfully.

Root Cause

The configuration validator assigned to conf->dns.interface.c was validate_stub, which performed type-based and dnsmasq syntax checks but did not reject embedded newlines. Once the field was written to the TOML file and re-emitted into the dnsmasq configuration, each newline became a directive boundary, allowing attacker-controlled options such as dhcp-script to be honored by dnsmasq.

Attack Vector

The attack requires network access to the Pi-hole FTL configuration API. With no admin password set, the attacker submits a crafted dns.interface value containing a newline followed by dhcp-script=/path/to/binary. The attacker then enables the built-in DHCP server through the same unauthenticated API. When any device on the network requests a DHCP lease, dnsmasq invokes the attacker-specified script as the FTL service user, yielding arbitrary command execution. The injected configuration is persisted and survives service restarts.

 	conf->dns.interface.t = CONF_STRING;
 	conf->dns.interface.f = FLAG_RESTART_FTL;
 	conf->dns.interface.d.s = (char*)"";
-	conf->dns.interface.c = validate_stub; // Type-based checking + dnsmasq syntax checking
+	conf->dns.interface.c = validate_str_no_newline;
 	
 	conf->dns.hostRecord.k = "dns.hostRecord";

Source: GitHub Commit 0c46e4ec — the patch replaces validate_stub with validate_str_no_newline, rejecting any dns.interface value containing a newline before it reaches the configuration writer.

Detection Methods for CVE-2026-39849

Indicators of Compromise

• Unexpected dhcp-script, dhcp-option, or other DHCP directives present in /etc/pihole/pihole.toml or the rendered dnsmasq configuration.
• The Pi-hole built-in DHCP server enabled on a deployment that historically used an upstream DHCP server.
• New executables in writable paths such as /tmp/ referenced by dhcp-script directives.
• Unexplained child processes spawned by the pihole-FTL or dnsmasq process around DHCP lease events.

Detection Strategies

• Inspect /etc/pihole/pihole.toml for embedded newline characters or unexpected directives appearing inside the dns.interface value.
• Compare the generated dnsmasq configuration against a known-good template; any directive outside interface= for the configured interface warrants investigation.
• Audit configuration API access logs for unauthenticated PATCH/PUT requests targeting the dns.interface key.

Monitoring Recommendations

• Alert on process creations where the parent is dnsmasq or pihole-FTL and the child is a shell or interpreter.
• Monitor write events to /etc/pihole/pihole.toml and the active dnsmasq configuration directory.
• Track changes to DHCP server state on Pi-hole hosts and correlate with configuration API activity.

How to Mitigate CVE-2026-39849

Immediate Actions Required

• Upgrade Pi-hole FTL to version 6.6.1 or later, which replaces validate_stub with validate_str_no_newline for the dns.interface field.
• Set a strong admin password on every Pi-hole deployment to require authentication for configuration API calls.
• Restrict network exposure of the Pi-hole web and API interfaces to trusted management segments only.
• Review /etc/pihole/pihole.toml for injected directives and revert any unauthorized changes before restarting the service.

Patch Information

The fix is delivered in Pi-hole FTL release v6.6.1. The validator change is documented in GitHub Security Advisory GHSA-9cqv-839p-gpq2 and implemented in commit 0c46e4ec.

Workarounds

• Configure an admin password so the configuration API rejects unauthenticated writes until the patched version is deployed.
• Block access to the Pi-hole web interface and API from untrusted VLANs using host or network firewall rules.
• Disable the built-in Pi-hole DHCP server if not required, reducing the impact of dhcp-script directive injection.
• Run Pi-hole FTL with file integrity monitoring on /etc/pihole/pihole.toml to detect tampering between scheduled patch windows.

# Verify installed FTL version and upgrade
pihole -v
pihole -up

# Set an admin password to require authenticated config API access
pihole -a -p

# Inspect the persisted configuration for injected newlines or DHCP directives
grep -nE 'interface|dhcp-script|dhcp-option' /etc/pihole/pihole.toml