CVE-2026-35517Disclosure(pi-hole / ftldns)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch pi-hole ftldns systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.

pi-hole CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj

Weakness type (CWE)

CWE-78CWE-93

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ftldns

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 3 mentions (2026-04-07); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

pi-hole

Products

ftldns

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-07	3	Disclosure2Patch1
2026-04-14	1	Disclosure1

Full discourse4 posts

Kerem 🛡 Cyber Security Engineer@keraattin177d
Disclosure
CVE-2026-35517 | Pi-hole FTLDNS RCE | CVSS 8.8 A newline character (\n) in a DNS config field gives you command execution on the host. Not a buffer overflow. Not a deserialization bug. A newline. Affects FTLDNS 6.0-6.5. Five injection vectors. Thread:
Post summary
The text announces CVE-2026-35517, an RCE vulnerability in FTLDNS 6.0-6.5 caused by a newline injection, but provides no PoC, exploit code, patches, or evidence of active exploitation.
12041339
1.2K followersView on X
CVE@CVEnew183d
Disclosure
CVE-2026-35517 FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a R… https://www.cve.org/CVERecord?id=CVE-2026-35517
Post summary
The excerpt references CVE-2026-35517 and hints at a vulnerability in Pi‑hole's FTL engine, but lacks substantive details on exploitation or mitigation.
00000121
57.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds183d
Disclosure
CVE-2026-35517 Remote Code Execution in Pi-hole FTL 6.0 Through 6.5 via DNS Configuration Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35517
Post summary
The post announces CVE‑2026‑35517 as a remote code execution flaw in Pi‑hole FTL 6.0‑6.5 through DNS configuration injection, but it provides no proof of concept, exploit code, or patch information.
0000047
4.0K followersView on X
CVEFind.com@CveFindCom184d
Patch
[CVE-2026-35517: HIGH] Pi-hole FTL engine prior to version 6.6 had a Remote Code Execution vulnerability in dns.upstreams config. Authenticated attackers could exploit it to execute commands. Update to versi...#cve,CVE-2026-35517,#cybersecurity https://cvefind.com/CVE-2026-35517
Post summary
Pi-hole’s FTL engine (prior to v6.6) contains a high‑severity RCE flaw (CVE-2026-35517) that allows authenticated attackers to execute commands via the dns.upstreams config; updating to the latest version mitigates the issue.
0000031
619 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	pi-hole	ftldns	-	-	-

Explore more

Back to dashboard pi-hole CVEs ftldns vulnerabilities

What researchers are saying

CVE-2026-35517

Kerem 🛡 Cyber Security Engineer[verified]@keraattinDisclosure

The text announces CVE-2026-35517, an RCE vulnerability in FTLDNS 6.0-6.5 caused by a newline injection, but provides no PoC, exploit code, patches, or evidence of active exploitation.

CVE@CVEnewDisclosure

The excerpt references CVE-2026-35517 and hints at a vulnerability in Pi‑hole's FTL engine, but lacks substantive details on exploitation or mitigation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE‑2026‑35517 as a remote code execution flaw in Pi‑hole FTL 6.0‑6.5 through DNS configuration injection, but it provides no proof of concept, exploit code, or patch information.

CVEFind.com@CveFindComPatch

Pi-hole’s FTL engine (prior to v6.6) contains a high‑severity RCE flaw (CVE-2026-35517) that allows authenticated attackers to execute commands via the dns.upstreams config; updating to the latest version mitigates the issue.