CVE-2026-41489: Pi-hole Privilege Escalation Vulnerability

CVE-2026-41489 Overview

CVE-2026-41489 is a local privilege escalation vulnerability in Pi-hole, a DNS sinkhole used to block unwanted content network-wide. The flaw affects Pi-hole versions from 6.0 up to (but not including) Core 6.4.2 and FTL 6.6.1. Two systemd-invoked shell scripts, pihole-FTL-prestart.sh and pihole-FTL-poststop.sh, run as root and consume the files.pid configuration value without validation. An attacker holding pihole group privileges can redirect those privileged file operations to arbitrary paths. On a default installation, this enables root-level compromise by planting an SSH key in /root/.ssh/authorized_keys.

Critical Impact
Local attackers with pihole user privileges can escalate to root by abusing unvalidated configuration input used in privileged install and rm -f operations.

Affected Products

Pi-hole Core versions 6.0 through 6.4.1
Pi-hole FTL versions 6.0 through 6.6.0
Default Pi-hole installations running systemd-managed FTL service

Discovery Timeline

2026-05-11 - CVE-2026-41489 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41489

Vulnerability Analysis

The vulnerability resides in two helper scripts executed by systemd as root: pihole-FTL-prestart.sh (invoked via ExecStartPre) and pihole-FTL-poststop.sh (invoked via ExecStopPost). Both scripts read the files.pid value from the Pi-hole configuration and use it directly in privileged file operations. The prestart script calls install to create the PID file, while the poststop script calls rm -f against the same path.

Neither script validates that the configured path points to an expected location. The Pi-hole configuration is writable by accounts in the pihole group, allowing a low-privileged local account to alter files.pid to any filesystem path. When the FTL service restarts, root performs delete-and-recreate operations against that attacker-controlled target, ultimately yielding write access to the new file.

Root Cause

The root cause is improper external variable handling [CWE-15]. The scripts trust user-influenced configuration data to construct paths used in root-owned filesystem operations. Operations remain bounded by ProtectSystem=full-restricted, but writable directories such as /root remain reachable, defeating the intended isolation.

Attack Vector

An attacker with pihole privileges writes an arbitrary path (for example, /root/.ssh/authorized_keys) into the files.pid configuration field. They then trigger an FTL service restart. If authorized_keys does not exist (common on fresh installs), only ExecStartPre runs, and root creates the file with attacker-controlled contents through the subsequent ownership flow. If the file exists, ExecStopPost deletes it first via rm -f, then ExecStartPre recreates it during the same restart cycle. The attacker then writes an SSH public key into the recreated file and logs in as root over SSH.

A technical writeup is available in the Pi-hole GitHub Security Advisory.

Detection Methods for CVE-2026-41489

Indicators of Compromise

Unexpected modifications to the files.pid value in Pi-hole configuration files
Creation, deletion, or modification of /root/.ssh/authorized_keys correlated with pihole-FTL service restarts
New or unfamiliar SSH public keys appearing in any user's authorized_keys file
pihole-FTL service restarts initiated by non-administrative accounts

Detection Strategies

Audit Pi-hole configuration changes that target the files.pid key, especially values pointing outside /run or /var/run
Monitor systemd journal entries for pihole-FTL.service start and stop events that coincide with sensitive file changes
Use file integrity monitoring on /root/.ssh/, /etc/sudoers.d/, and other privileged write targets

Monitoring Recommendations

Enable auditd rules on authorized_keys files and Pi-hole configuration directories
Alert on install or rm invocations by root that operate on paths outside expected runtime directories
Track membership changes to the pihole group and review which accounts hold that privilege

How to Mitigate CVE-2026-41489

Immediate Actions Required

Upgrade Pi-hole Core to version 6.4.2 or later and FTL to version 6.6.1 or later
Review the current files.pid configuration value and reset it to the default runtime path
Audit /root/.ssh/authorized_keys and other privileged files for unauthorized entries
Restrict membership in the pihole group to trusted administrators only

Patch Information

The vulnerability is fixed in Pi-hole Core 6.4.2 and FTL 6.6.1. The fixes introduce path validation for files.pid before it is consumed by the privileged systemd helper scripts. Refer to the Pi-hole Security Advisory GHSA-6w8x-p785-6pm4 for full upgrade guidance.

Workarounds

Remove unnecessary local accounts from the pihole group until patching is complete
Tighten systemd unit hardening for pihole-FTL.service by adding ReadWritePaths= constraints limited to expected runtime directories
Apply stricter ProtectSystem and ProtectHome settings to block writes to /root from the service context

bash

# Verify installed Pi-hole versions and upgrade
pihole -v
pihole -up

# Confirm files.pid points to an expected runtime path
grep -R "files.pid" /etc/pihole/