Is CVE-2026-39849 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39849 being exploited in the wild.

How severe is CVE-2026-39849?

High severity, with a CVSS score of 8.8, published 5 May 2026.

Is there a fix for CVE-2026-39849?

A patch was published on 2026-04-24: Version 6.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39849 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39849?

Check whether you run Pi-hole FTL or Pi-hole Ftldns at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39849: Pi-hole FTL newline injection in dns.interface configuration

CVE-2026-39849 · Severity: high · CVSS 8.8 · Published 2026-05-05

Pi-hole FTL is the core engine for the Pi-hole advertisement and tracker blocker. A security flaw allows an attacker on the same network to take full control of the device by injecting malicious commands into its configuration. This is particularly dangerous for installations using the default setting of no administrator password, as it allows for remote code execution without any credentials.

Technologies: Pi-hole FTL, Pi-hole Ftldns. Vendors: Pi-hole.

Quick answers

Is CVE-2026-39849 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39849 being exploited in the wild.
How severe is CVE-2026-39849?: High severity, with a CVSS score of 8.8, published 5 May 2026.
Which products and versions are affected?: Pi-hole FTL < 6.6.1, 6.6.
Is there a fix for CVE-2026-39849?: A patch was published on 2026-04-24: Version 6.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39849 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39849?: Check whether you run Pi-hole FTL or Pi-hole Ftldns at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A newline injection vulnerability exists in the `dns.interface` configuration field of Pi-hole FTL due to improper validation using a stub validator. An attacker can use the PATCH /api/config endpoint to inject arbitrary dnsmasq directives, such as `dhcp-script`, into the generated configuration file. While the field is limited to 31 bytes by a `strncpy` operation, this is sufficient to inject a script path. When a DHCP lease is requested on the network, the injected script is executed with the privileges of the FTL process. On default installations without an admin password, no authentication is required to reach the vulnerable API. This issue is resolved in version 6.6.1 by implementing proper newline validation.

Affected products

Pi-hole FTL < 6.6.1

Timeline

2026-04-24: patched: Version 6.6.1 released
2026-05-05: disclosed: Initial CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.