Executive brief
Pi-hole is a popular network-level advertisement and tracker blocker used to protect home and corporate networks. A flaw in its core engine allows an unauthorized person on the same network to steal an administrator's login session by sending many simultaneous requests at the exact moment the admin is logged in. If successful, the attacker gains full control over the device's settings, allowing them to disable security features or redirect network traffic.
Technical details
A race condition exists in Pi-hole FTL's embedded CivetWeb-based web server due to the use of a shared global character buffer, 'pi_hole_extra_headers', for managing HTTP 'Set-Cookie' headers. Because the server dispatches requests across multiple worker threads without proper synchronization (mutexes or atomics), a thread handling an unauthenticated request can read the session ID (SID) written to the global buffer by a thread handling a concurrent administrative request. An attacker on the local network can exploit this by flooding public API endpoints like '/api/info/login' to capture a valid administrator SID. The vulnerability was introduced in the v6.0 rewrite and is mitigated in v6.6.1 by moving the buffer to thread-local storage.
Affected products
- Pi-hole FTL 6.0 to 6.6.0
Timeline
- 2026-04-24: patched: Fixed in FTL v6.6.1 via PR #2835
- 2026-05-16: advisory: Security advisory GHSA-9ff5-f3v5-2xc7 published
- 2026-06-10: disclosed: CVE-2026-44693 published to NVD