Is CVE-2026-41489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41489 being exploited in the wild.

How severe is CVE-2026-41489?

High severity, with a CVSS score of 8.8, published 11 May 2026.

Which products and versions are affected?

Pi-hole FTL 6.0 to before 6.6.1.

Is there a fix for CVE-2026-41489?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41489 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-41489?

Check whether you run Pi-hole FTL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41489: Pi-hole local privilege escalation via unvalidated config paths

CVE-2026-41489 · Severity: high · CVSS 8.8 · Published 2026-05-11

Pi-hole is a network-wide ad and tracker blocker. A security flaw allows a user with limited access to the Pi-hole service to trick the system into deleting or creating files with administrative (root) privileges. In practice, an attacker could use this to gain full control over the host machine, for example, by adding their own login keys to the administrator's account or corrupting critical system databases.

Technologies: Pi-hole FTL. Vendors: Pi-hole.

Quick answers

Is CVE-2026-41489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41489 being exploited in the wild.
How severe is CVE-2026-41489?: High severity, with a CVSS score of 8.8, published 11 May 2026.
Which products and versions are affected?: Pi-hole FTL 6.0 to before 6.6.1.
Is there a fix for CVE-2026-41489?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41489 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-41489?: Check whether you run Pi-hole FTL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in Pi-hole versions 6.0 through Core 6.4.1 and FTL 6.6.0. The non-root 'pihole' user has write access to the configuration file 'pihole.toml'. Two shell scripts, 'pihole-FTL-prestart.sh' and 'pihole-FTL-poststop.sh', are executed as root by systemd and read the 'files.pid' path from this configuration without validation. By poisoning this path, an attacker can use 'rm -f' and 'install' commands within the scripts to delete arbitrary files or create new files owned by the 'pihole' user in sensitive locations (e.g., /root/.ssh/authorized_keys). This allows a low-privileged attacker to gain full root access or cause a denial of service by deleting critical system files. The issue is fixed in Core 6.4.2 and FTL 6.6.1.

Affected products

Pi-hole Pi-hole Core 6.0 to before 6.4.2
Pi-hole Pi-hole FTL 6.0 to before 6.6.1

Timeline

2026-04-24: advisory: GitHub Security Advisory published by Pi-hole team
2026-05-11: disclosed: CVE-2026-41489 published to NVD

References

https://github.com/pi-hole/pi-hole/security/advisories/GHSA-6w8x-p785-6pm4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.