Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter imports for CLI sessions, enabling a CLI-scoped session to overwrite configuration via a Teleporter archive (authorization bypass). This vulnerability is fixed in 6.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35491 Authorization Bypass in Pi-hole FTL 6.0 Through 6.5 via Teleporter API https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35491
Post summary
The post announces CVE-2026-35491, detailing an authorization bypass in Pi‑hole FTL 6.0‑6.5 through the Teleporter API, but provides no PoC, exploit, or patch information.
CVE-2026-35491 FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password… https://www.cve.org/CVERecord?id=CVE-2026-35491
Post summary
The text simply links to the CVE record for CVE‑2026‑35491 with a short description, offering no additional details on exploitation, patching, or technical specifics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pi-hole | ftldns | - | - | - |