CVE-2026-50130 Details
Description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.
A local privilege escalation vulnerability has been identified in Pi-hole versions 6.0 through 6.4.2. The issue allows a user with code execution as the unprivileged 'pihole' user to escalate privileges to root. This is achieved by replacing the logrotate configuration file in an attacker-writable directory. The replacement file is then owned by root after being processed by a startup script, and subsequently executed as root by a scheduled cron job, leading to unauthorized actions being performed with elevated privileges.
Users can update to Pi-hole version 6.4.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/pi-hole/pi-hole/commit/18002bf7c6bf382fe5861d01321f427019e1be89 | [email protected] | Patch |
| https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3 | [email protected] | ProductRelease Notes |
| https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-282 | Improper Ownership Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pi-hole pi-hole | >= 6.0, < 6.4.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |