Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35518 FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a R… https://www.cve.org/CVERecord?id=CVE-2026-35518
Post summary
The post announces CVE‑2026‑35518, a vulnerability in Pi‑hole’s FTL engine, and provides a link to the public CVE record without additional technical or exploit details.
CVE-2026-35518 Remote Code Execution in FTLDNS Pi-hole FTL Versions 6.0 Through 6.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35518
Post summary
CVE-2026-35518 is a remote code execution flaw affecting FTLDNS Pi‑hole FTL versions 6.0‑6.5, with no PoC, exploit code, or active exploitation reported.
[CVE-2026-35518: HIGH] Cybersecurity alert: Pi-hole FTL engine versions 6.0 to 6.6 contain an RCE vulnerability. Update to version 6.6 to fix the DNS CNAME records issue and avoid potential attacks.#cve,CVE-2026-35518,#cybersecurity https://cvefind.com/CVE-2026-35518
Post summary
The alert reports a high‑severity RCE in Pi‑hole’s FTL engine versions 6.0‑6.6 and advises updating to version 6.6 to resolve the DNS CNAME issue and prevent potential attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pi-hole | ftldns | - | - | - |