CVE-2026-44693: Pi-hole FTL Race Condition Vulnerability

CVE-2026-44693 Overview

CVE-2026-44693 is a race condition vulnerability in Pi-hole FTL, the core engine behind the Pi-hole network-level advertisement and tracker blocker. The flaw resides in the HTTP session management subsystem introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. All versions prior to 6.6.1 are affected. The maintainers patched the issue in Pi-hole FTL v6.6.1.

The weakness is classified as [CWE-362] Concurrent Execution using Shared Resource with Improper Synchronization. An attacker can exploit the race window over the network to compromise confidentiality, integrity, and availability of the administrative web interface.

Critical Impact
A remote attacker who induces an authenticated administrator to interact with attacker-controlled content can hijack the web session and gain administrative control of the Pi-hole instance.

Affected Products

Pi-hole FTL versions 6.0 through 6.6.0
Pi-hole deployments using the CivetWeb-based embedded web server introduced in v6.0
Self-hosted Pi-hole DNS sinkhole appliances exposing the admin interface on local networks

Discovery Timeline

2026-06-10 - CVE-2026-44693 published to NVD
2026-06-10 - Last updated in NVD database
Patch released - Pi-hole FTL v6.6.1 published on GitHub with the fix

Technical Details for CVE-2026-44693

Vulnerability Analysis

The vulnerability stems from improper synchronization in the HTTP session management code path of Pi-hole FTL. When the v6.0 release replaced the prior web stack with an embedded CivetWeb server, the session lookup and state-update logic introduced a window in which concurrent requests can operate on the same shared session structure. Two HTTP requests arriving close together can observe or mutate session state before the owning handler completes its update.

The race exposes session identifiers and authentication state to manipulation. An attacker with network reach to the admin interface can issue concurrent requests timed against legitimate administrator activity. Successful exploitation yields control over a privileged session, allowing arbitrary changes to DNS blocklists, upstream resolvers, and query logs.

Root Cause

The root cause is missing or insufficient locking around shared HTTP session state inside the CivetWeb integration shipped with FTL v6.0. Concurrent request handlers read and write the same session structure without atomic guarantees. This matches the [CWE-362] race condition pattern, where correctness depends on a sequence of operations executing without interleaving from another thread.

Attack Vector

The attack vector is network-based and requires user interaction from an authenticated administrator, consistent with the published CVSS vector. A common exploitation path involves the attacker hosting a malicious page or sending a crafted link that triggers concurrent cross-origin or same-origin requests against the Pi-hole admin endpoint while the administrator is logged in. The race window is then driven by request pacing to capture or hijack the session.

No public proof-of-concept exploit code is available at the time of publication. Technical details are available in the Pi-hole FTL security advisory GHSA-9ff5-f3v5-2xc7.

Detection Methods for CVE-2026-44693

Indicators of Compromise

Unexpected administrative changes to Pi-hole blocklists, whitelists, or upstream DNS resolvers without a corresponding admin audit entry
Multiple near-simultaneous HTTP requests to /admin/ endpoints originating from the same client within a sub-second window
New or unexpected sessions in FTL logs that do not correlate with a known administrator login event
Outbound DNS traffic patterns indicating the resolver configuration has been altered

Detection Strategies

Inspect pihole-FTL.log and the CivetWeb access log for bursts of concurrent requests targeting session-bearing endpoints
Alert on configuration-change API calls that occur outside expected administrative maintenance windows
Compare the running Pi-hole FTL version against v6.6.1 across all managed instances to identify vulnerable hosts

Monitoring Recommendations

Forward Pi-hole FTL web and query logs to a centralized log platform for correlation with network telemetry
Track admin session creation rates and flag spikes that suggest session enumeration or race exploitation
Monitor for changes to DNS resolver behavior on hosts that rely on Pi-hole for filtering

How to Mitigate CVE-2026-44693

Immediate Actions Required

Upgrade Pi-hole FTL to version 6.6.1 or later using the official update path on every deployed instance
Restrict access to the Pi-hole admin web interface to trusted management networks only, blocking exposure to untrusted segments
Rotate the Pi-hole admin password and invalidate existing sessions after patching
Review recent configuration changes and query logs for evidence of unauthorized modification

Patch Information

The fix is included in Pi-hole FTL release v6.6.1. Administrators should apply the update using pihole -up or by upgrading the FTL package through their distribution mechanism. Validate the running version after upgrade with pihole -v.

Workarounds

Place the Pi-hole admin interface behind a reverse proxy that enforces strict same-origin policies and rate limiting until patching is complete
Bind the FTL web listener to a management-only interface or restrict it via host firewall rules to known administrator IP addresses
Require administrators to log out of the Pi-hole web UI when not actively managing the device to shrink the race exploitation window

bash

# Configuration example: upgrade and verify Pi-hole FTL
sudo pihole -up
pihole -v | grep -i ftl
# Expected output should report FTL version v6.6.1 or later

# Restrict admin interface to a management subnet (example with iptables)
sudo iptables -A INPUT -p tcp --dport 80 -s 10.0.10.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j DROP