CVE-2026-35518

HighRCE

Published: 07 April 2026

Published

07 April 2026

Modified

08 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0048 65.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35518 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the RCE vulnerability by updating Pi-hole FTL from vulnerable versions (6.0 to <6.6) to the patched version 6.6.

SI-10 Information Input Validation good match

prevent

Validates and sanitizes inputs to the dns.cnameRecords API parameter to block newline injection of arbitrary dnsmasq directives, preventing OS command injection.

CM-6 Configuration Settings partial match

prevent

Enforces secure baseline configuration settings for Pi-hole FTL and dnsmasq to restrict improper CNAME records that could enable command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

Why these techniques?

RCE via OS command injection (CWE-78) in Pi-hole FTL API (web interface service) directly enables exploitation of public-facing application (T1190), exploitation of remote service (T1210), and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability…

allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Deeper analysisAI

CVE-2026-35518 is a Remote Code Execution (RCE) vulnerability, rated 8.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting the Pi-hole FTL engine (also known as FTLDNS), which provides an interactive API and generates statistics for Pi-hole's web interface. The issue impacts versions from 6.0 up to but not including 6.6 and stems from the DNS CNAME records configuration parameter (dns.cnameRecords). It allows injection of arbitrary dnsmasq configuration directives via newline characters, enabling command execution on the underlying system. The vulnerability is linked to CWE-78 (OS Command Injection) and CWE-93 (Improper Neutralization of CRLF Sequences).

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation grants high impacts on confidentiality, integrity, and availability, culminating in arbitrary command execution on the host system.

The vulnerability is addressed in Pi-hole FTL version 6.6. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m.