# CVE-2026-50130: Pi-hole local privilege escalation via logrotate configuration laundering

Source: https://junglewise.ai/threats/cve-2026-50130-pi-hole-local-privilege-escalation-via-logrotate-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-50130 · Severity: high · CVSS 8.8 · Published 2026-07-14

Pi-hole is a network-wide ad and tracker blocker. A security vulnerability allows a user who already has limited access to the Pi-hole system to gain full administrative (root) control. By replacing a specific configuration file and forcing the system to restart a background service, an attacker can trick the system into running malicious commands with the highest possible privileges during daily maintenance tasks.

Technologies: [Pi-hole](https://junglewise.ai/threats/technologies/pi-hole). Vendors: [Pi-hole](https://junglewise.ai/threats/vendors/pi-hole).

## Quick answers

**Is CVE-2026-50130 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50130 being exploited in the wild.

**How severe is CVE-2026-50130?** High severity, with a CVSS score of 8.8, published 14 July 2026.

**Which products and versions are affected?** Pi-hole 6.0 to 6.4.2.

**Is there a fix for CVE-2026-50130?** A patch was published on 2026-07-06: Fixed in version 6.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50130 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-50130?** Check whether you run Pi-hole at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability exists in Pi-hole versions 6.0 through 6.4.2. The root cause is a combination of insecure directory permissions for /etc/pihole/ (owned by the pihole user) and a 'laundering' mechanism in the pihole-FTL-prestart.sh script. An attacker with code execution as the 'pihole' user can delete the root-owned /etc/pihole/logrotate file and replace it with a malicious version. By restarting the pihole-FTL service (which the pihole user can do via SIGKILL), the prestart script runs as root and unconditionally changes the ownership of the malicious logrotate file back to root:root. When the daily cron job subsequently executes logrotate as root, it parses the attacker-controlled configuration, allowing for arbitrary command execution as root via logrotate script blocks (e.g., firstaction). This is fixed in version 6.4.3.

## Affected products

- Pi-hole Pi-hole 6.0 to 6.4.2

## Timeline

- 2026-07-06: patched: Fixed in version 6.4.3
- 2026-07-14: disclosed: Public advisory published

## References

- [https://github.com/pi-hole/pi-hole/commit/18002bf7c6bf382fe5861d01321f427019e1be89](https://github.com/pi-hole/pi-hole/commit/18002bf7c6bf382fe5861d01321f427019e1be89)
- [https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3](https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3)
- [https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww](https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww)

## Related threats

- [Pi-hole privilege escalation via symlink in updatecheck.sh](https://junglewise.ai/threats/cve-2026-119336-pi-hole-is-a-dns-sinkhole-that-protects-devices-from-unwanted)
- [Pi-hole privilege escalation in PID file validation](https://junglewise.ai/threats/cve-2026-119335-pi-hole-is-a-dns-sinkhole-that-protects-devices-from-unwanted)