CVE-2026-50130: Pi-hole Privilege Escalation Vulnerability

CVE-2026-50130 Overview

CVE-2026-50130 is a local privilege escalation vulnerability in Pi-hole, the DNS sinkhole widely deployed on home and small-business networks to block unwanted content. Versions 6.0 through 6.4.2 allow an attacker with code execution as the unprivileged pihole user to escalate to root. The flaw resides in how pihole-FTL-prestart.sh relaunders the /etc/pihole/logrotate file to root:root ownership. The daily flush cron then parses the attacker-controlled file as root, executing the firstaction shell directive with UID 0. The issue is fixed in version 6.4.3 and classified under [CWE-282: Improper Ownership Management].

Critical Impact
An attacker with pihole user code execution can achieve full root compromise of the underlying host through a scheduled cron job.

Affected Products

Pi-hole 6.0 through 6.4.2
Systems using pihole-FTL-prestart.sh and the daily pihole flush cron
Fixed in Pi-hole 6.4.3

Discovery Timeline

2026-07-14 - CVE-2026-50130 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50130

Vulnerability Analysis

Pi-hole's logrotate configuration is stored at /etc/pihole/logrotate, a path writable by the pihole user. During service startup, pihole-FTL-prestart.sh re-chowns this file to root:root, effectively laundering the attacker's controlled content into a root-owned configuration. The daily pihole flush cron job then invokes /usr/sbin/logrotate as root against that same file. Because logrotate supports the firstaction/lastaction directives, which spawn arbitrary shell commands, an attacker who has replaced the file executes commands with UID 0. The attack chain requires no exploitation of memory-corruption primitives; it abuses trust in a file path whose ownership is normalized by a privileged helper.

Root Cause

The root cause is improper ownership management [CWE-282]. The pihole-FTL-prestart.sh script assumes the on-disk /etc/pihole/logrotate is trusted and chowns it to root without validating provenance or contents. The system therefore promotes attacker-controlled data into a privileged execution context.

Attack Vector

Exploitation requires local code execution as the unprivileged pihole user, which can be obtained through any prior compromise of the Pi-hole web UI, FTL service, or a co-resident process. The attacker replaces /etc/pihole/logrotate with a payload containing a firstaction block. On service restart or at cron time, the payload runs as root.

bash

# Patch: advanced/Scripts/piholeDebug.sh
 WEB_GIT_DIRECTORY="${HTML_DIRECTORY}${WEBHOME_PATH}"
 SHM_DIRECTORY="/dev/shm"
 ETC="/etc"
+ETC_LOGROTATE_DIRECTORY="${ETC}/logrotate.d"

 PIHOLE_CRON_FILE="${CRON_D_DIRECTORY}/pihole"
 PIHOLE_INSTALL_LOG_FILE="${PIHOLE_DIRECTORY}/install.log"
 PIHOLE_RAW_BLOCKLIST_FILES="${PIHOLE_DIRECTORY}/list.*"
-PIHOLE_LOGROTATE_FILE="${PIHOLE_DIRECTORY}/logrotate"
+PIHOLE_LOGROTATE_FILE="${ETC_LOGROTATE_DIRECTORY}/pihole"

# Patch: advanced/Scripts/piholeLogFlush.sh
-    /usr/sbin/logrotate --force --state "${STATEFILE}" /etc/pihole/logrotate
+    /usr/sbin/logrotate --force --state "${STATEFILE}" /etc/logrotate.d/pihole
# Source: https://github.com/pi-hole/pi-hole/commit/18002bf7c6bf382fe5861d01321f427019e1be89

The fix relocates the logrotate configuration to /etc/logrotate.d/pihole, a directory not writable by the pihole user, breaking the launder-and-execute chain.

Detection Methods for CVE-2026-50130

Indicators of Compromise

Modifications to /etc/pihole/logrotate by the pihole user account
Unexpected firstaction, lastaction, prerotate, or postrotate directives inside /etc/pihole/logrotate
Child processes of /usr/sbin/logrotate running with UID 0 that spawn shells or network utilities
Ownership changes on /etc/pihole/logrotate immediately followed by cron-triggered execution

Detection Strategies

Monitor file integrity on /etc/pihole/logrotate and alert on any writes by non-root accounts
Audit execve calls whose parent process is logrotate and whose UID transitions from pihole to root
Track invocations of pihole-FTL-prestart.sh that are followed by chown operations on files in /etc/pihole/

Monitoring Recommendations

Enable Linux auditd rules on /etc/pihole/ and /etc/logrotate.d/pihole for write and attribute changes
Correlate cron-triggered executions of pihole flush with unexpected outbound network activity
Baseline the expected contents of the Pi-hole logrotate configuration and alert on drift

How to Mitigate CVE-2026-50130

Immediate Actions Required

Upgrade Pi-hole to version 6.4.3 or later without delay
Inspect /etc/pihole/logrotate for unauthorized firstaction, lastaction, or postrotate blocks before upgrading
Rotate credentials and audit the host if any tampering is found, since root compromise may have occurred

Patch Information

The fix is delivered in Pi-hole Release v6.4.3. The remediation moves the logrotate configuration from the writable /etc/pihole/ directory to /etc/logrotate.d/pihole, which the pihole user cannot modify. Full technical context is available in GitHub Security Advisory GHSA-h8w9-qx2v-wrww and the remediation commit.

Workarounds

Manually chown /etc/pihole/logrotate to root:root and set mode 0644, then remove write access for the pihole user until patching is complete
Disable the daily pihole flush cron entry temporarily to prevent the privileged parse of the file
Restrict local shell access to the pihole account and audit web UI plugins that may enable code execution