CVE-2026-35521
Published: 07 April 2026
Summary
CVE-2026-35521 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-35521 is a Remote Code Execution (RCE) vulnerability in the Pi-hole FTL engine, also known as FTLDNS, which provides an interactive API and generates statistics for Pi-hole's Web interface. The issue affects versions from 6.0 up to but not including 6.6 and stems from the DHCP hosts configuration parameter (dhcp.hosts), where attackers can inject arbitrary dnsmasq configuration directives through newline characters ('CRLF injection'), ultimately achieving command execution on the underlying system. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78 (OS Command Injection) and CWE-93 (Improper Neutralization of CRLF Sequences).
The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low complexity and no user interaction. Successful exploitation allows the attacker to execute arbitrary commands on the host system, resulting in high impacts to confidentiality, integrity, and availability.
The vulnerability is addressed in Pi-hole FTL version 6.6. Additional details on the issue and mitigation are available in the GitHub security advisory at https://github.com/pi-hole/FTL/security/advisories/GHSA-vfmq-jrx3-wv3c.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19715
Vulnerability details
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows…
more
an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via OS command injection (CWE-78) in Pi-hole FTL API/web interface (public-facing application), directly enabling T1190; exploits Unix shell for command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates inputs to the dhcp.hosts configuration parameter to neutralize CRLF sequences and block arbitrary dnsmasq directives, directly preventing the command injection RCE.
Mandates timely remediation of flaws like this RCE vulnerability by patching Pi-hole FTL to version 6.6 or later.
Restricts access to system components controlling changes to the vulnerable dhcp.hosts parameter, limiting exploitation opportunities for low-privilege authenticated attackers.