CVE-2026-33404
Last modified
CVE-2026-33404 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pi-Hole | Web Interface | >= 6.0, <= 6.4.1 |
References
- https://github.com/pi-hole/web/security/advisories/GHSA-px6w-85wp-ww9vThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33404?
How severe is CVE-2026-33404?
How do I fix CVE-2026-33404?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33399Wallos is an open-source, self-hostable personal subscriptio…7.7
- CVE-2026-3340IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vul…6.5
- CVE-2026-33400Wallos is an open-source, self-hostable personal subscriptio…5.4
- CVE-2026-33401Wallos is an open-source, self-hostable personal subscriptio…6.5
- CVE-2026-33402Sakai is a Collaboration and Learning Environment (CLE). In …6.1
- CVE-2026-33403Pi-hole Admin Interface is a web interface for managing Pi-h…6.1
- CVE-2026-33405Pi-hole Admin Interface is a web interface for managing Pi-h…4.8
- CVE-2026-33406Pi-hole Admin Interface is a web interface for managing Pi-h…6.1
- CVE-2026-33407Wallos is an open-source, self-hostable personal subscriptio…9.1
- CVE-2026-33408Discourse is an open-source discussion platform. Prior to ve…2.7
- CVE-2026-33409Parse Server is an open source backend that can be deployed …9.1
- CVE-2026-3341IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vul…5.4
Are you affected by CVE-2026-33404?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST