CVE-2026-50130

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

• CWE-282

• https://github.com/pi-hole/pi-hole/commit/18002bf7c6bf382fe5861d01321f427019e1be89Patch
• https://github.com/pi-hole/pi-hole/releases/tag/v6.4.3Product, Release Notes
• https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrwwExploit, Mitigation, Vendor Advisory
• https://github.com/pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrwwExploit, Mitigation, Vendor Advisory

Published

Jul 14, 2026

Last Modified

Jul 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5012A flaw has been found in elecV2 elecV2P up to 3.8.3. This is…7.3
• CVE-2026-50124DataEase is an open source data visualization and analysis t…7.1
• CVE-2026-50127Weblate is a web based localization tool. From version 5.15 …5.9
• CVE-2026-50128Mastodon is a free, open-source social network server based …5.3
• CVE-2026-50129Mastodon is a free, open-source social network server based …7.5
• CVE-2026-5013A vulnerability has been found in elecV2 elecV2P up to 3.8.3…5.5
• CVE-2026-50131Fedify is a TypeScript library for building federated server…8.6
• CVE-2026-50132Budibase is an open-source low-code platform. Prior to 3.39.…7.3
• CVE-2026-50133Hugo is a static site generator. Prior to 0.162.0, Hugo acce…6.1
• CVE-2026-50134Hugo is a static site generator. From 0.91.0 until 0.162.0, …5.8
• CVE-2026-50135Hugo is a static site generator. From 0.123.0 to 0.161.1, a …5.5
• CVE-2026-50136Budibase is an open-source low-code platform. Prior to 3.39.…5.3