CVE-2026-35521

HighRCE

Published: 07 April 2026

Published

07 April 2026

Modified

08 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0048 65.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35521 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Validates inputs to the dhcp.hosts configuration parameter to neutralize CRLF sequences and block arbitrary dnsmasq directives, directly preventing the command injection RCE.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of flaws like this RCE vulnerability by patching Pi-hole FTL to version 6.6 or later.

CM-5 Access Restrictions for Change partial match

prevent

Restricts access to system components controlling changes to the vulnerable dhcp.hosts parameter, limiting exploitation opportunities for low-privilege authenticated attackers.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

RCE via OS command injection (CWE-78) in Pi-hole FTL API/web interface (public-facing application), directly enabling T1190; exploits Unix shell for command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows…

an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

Deeper analysisAI

CVE-2026-35521 is a Remote Code Execution (RCE) vulnerability in the Pi-hole FTL engine, also known as FTLDNS, which provides an interactive API and generates statistics for Pi-hole's Web interface. The issue affects versions from 6.0 up to but not including 6.6 and stems from the DHCP hosts configuration parameter (dhcp.hosts), where attackers can inject arbitrary dnsmasq configuration directives through newline characters ('CRLF injection'), ultimately achieving command execution on the underlying system. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78 (OS Command Injection) and CWE-93 (Improper Neutralization of CRLF Sequences).

The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation allows the attacker to execute arbitrary commands on the host system, resulting in high impacts to confidentiality, integrity, and availability.

The vulnerability is addressed in Pi-hole FTL version 6.6. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c.