CVE-2026-44693 Details

A race condition vulnerability has been identified in Pi-hole FTL versions 6.0 prior to 6.6.1, within the HTTP session management subsystem. This vulnerability, introduced in the v6.0 rewrite of the embedded CivetWeb-based web server, allows an unauthenticated attacker on the local network to hijack an administrator's session. The issue arises because a global buffer used to pass Set-Cookie headers, including the session ID, is not properly synchronized, enabling concurrent threads to interfere with each other. Exploitation involves sending simultaneous requests to public API endpoints, potentially capturing the session ID of an active administrator and gaining full administrative access without credentials.

Users can upgrade to Pi-hole FTL version 6.6.1 or later, where this vulnerability has been fixed.