CVE-2026-50130

HIGH

Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-50130 has a selected CVSS score of 8.8 (high).

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 15, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

pi-hole

Browse pi-hole / pi-hole
CVE List>= 6.0.0, < 6.4.3affected

References

3