CVE-2026-35520
Published: 07 April 2026
Summary
CVE-2026-35520 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-35520 is a remote code execution (RCE) vulnerability in the Pi-hole FTL engine, also known as FTLDNS, which provides an interactive API and generates statistics for Pi-hole's web interface. Affecting versions from 6.0 up to but not including 6.6, the flaw resides in the DHCP lease time configuration parameter (dhcp.leaseTime). It enables an authenticated attacker to inject arbitrary dnsmasq configuration directives by exploiting newline characters, resulting in command execution on the underlying system. The vulnerability is associated with CWE-78 (OS Command Injection) and CWE-93 (Improper Neutralization of CRLF Sequences), and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By manipulating the dhcp.leaseTime parameter through the FTL API, the attacker injects malicious dnsmasq directives separated by newlines, which the engine processes and executes as system commands. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially allowing full compromise of the host system running Pi-hole.
The official advisory on GitHub (GHSA-fqv2-qhfh-ghcj) confirms the vulnerability is fixed in Pi-hole FTL version 6.6, recommending immediate upgrades for affected installations. No additional mitigations are detailed beyond patching, emphasizing the need for authentication controls on the FTL API in the interim.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19713
Vulnerability details
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability…
more
allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution via OS command injection (T1059.004) through a web interface API parameter in Pi-hole FTL, exploitable as a public-facing application weakness (T1190) by low-privileged authenticated users, facilitating privilege escalation to system takeover (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation through patching to Pi-hole FTL version 6.6 directly eliminates the RCE vulnerability in the dhcp.leaseTime parameter processing.
Information input validation at the FTL API enforces sanitization of the dhcp.leaseTime parameter to block newline injections and malicious dnsmasq directives.
Least privilege restricts low-privilege authenticated users from accessing or modifying the vulnerable dhcp.leaseTime configuration parameter via the API.