Is CVE-2026-44693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44693 being exploited in the wild.

How severe is CVE-2026-44693?

High severity, with a CVSS score of 8.8, published 10 June 2026.

Is there a fix for CVE-2026-44693?

A patch was published on 2026-04-24: Fixed in FTL v6.6.1 via PR #2835 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44693 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44693?

Check whether you run Pi-hole FTL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44693: Pi-hole FTL session hijacking via race condition in HTTP engine

CVE-2026-44693 · Severity: high · CVSS 8.8 · Published 2026-06-10

Pi-hole is a popular network-level advertisement and tracker blocker used to protect home and corporate networks. A flaw in its core engine allows an unauthorized person on the same network to steal an administrator's login session by sending many simultaneous requests at the exact moment the admin is logged in. If successful, the attacker gains full control over the device's settings, allowing them to disable security features or redirect network traffic.

Technologies: Pi-hole FTL. Vendors: Pi-hole.

Quick answers

Is CVE-2026-44693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44693 being exploited in the wild.
How severe is CVE-2026-44693?: High severity, with a CVSS score of 8.8, published 10 June 2026.
Which products and versions are affected?: Pi-hole FTL 6.0 to 6.6.0.
Is there a fix for CVE-2026-44693?: A patch was published on 2026-04-24: Fixed in FTL v6.6.1 via PR #2835 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44693 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44693?: Check whether you run Pi-hole FTL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in Pi-hole FTL's embedded CivetWeb-based web server due to the use of a shared global character buffer, 'pi_hole_extra_headers', for managing HTTP 'Set-Cookie' headers. Because the server dispatches requests across multiple worker threads without proper synchronization (mutexes or atomics), a thread handling an unauthenticated request can read the session ID (SID) written to the global buffer by a thread handling a concurrent administrative request. An attacker on the local network can exploit this by flooding public API endpoints like '/api/info/login' to capture a valid administrator SID. The vulnerability was introduced in the v6.0 rewrite and is mitigated in v6.6.1 by moving the buffer to thread-local storage.

Affected products

Pi-hole FTL 6.0 to 6.6.0

Timeline

2026-04-24: patched: Fixed in FTL v6.6.1 via PR #2835
2026-05-16: advisory: Security advisory GHSA-9ff5-f3v5-2xc7 published
2026-06-10: disclosed: CVE-2026-44693 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.