CVE-2026-44693: Pi-hole FTL Race Condition in HTTP Session Management

Technical summary

CVE-2026-44693 is a CWE-362 race condition affecting Pi-hole FTL versions prior to 6.6.1, specifically in the HTTP session management subsystem of the embedded CivetWeb-based web server. The vulnerability stems from the v6.0 rewrite of the web server and manifests as a timing-dependent flaw in session handling logic. An attacker can exploit unsynchronized access to session state during concurrent requests to bypass authentication controls or hijack authenticated sessions. The race condition window is typically brief but exploitable under normal network conditions, particularly when an administrator is actively using the web interface.

Business impact

Successful exploitation could allow an attacker to gain administrative control over a Pi-hole instance, which serves as a critical network infrastructure component. An attacker could disable DNS filtering, redirect traffic, exfiltrate DNS query logs (which may contain sensitive information about network activity), or pivot to other systems on the local network. For small businesses, SMBs, and home networks relying on Pi-hole for security and privacy, this represents a direct threat to network defense posture. Organizations using Pi-hole as part of their DNS security strategy should treat this as a high-priority remediation item.

Affected systems

All versions of Pi-hole FTL prior to version 6.6.1 are affected. This includes all v6.0.x through v6.6.0 releases. Users running version 6.6.1 or later are not vulnerable. The vulnerability is specific to Pi-hole FTL and does not affect standalone Pi-hole deployments that do not use FTL, though modern Pi-hole installations typically include FTL as the default DNS engine.

Exploitability

The vulnerability has a CVSS 3.1 score of 8.8 (HIGH) with a network vector (AV:N), low attack complexity (AC:L), and no privilege requirements (PR:N). However, it does require user interaction (UI:R), typically in the form of an administrator clicking a malicious link or visiting a compromised site while maintaining an active Pi-hole session. An attacker would need to craft a request that triggers the race condition during a concurrent legitimate session. While not trivial, this is achievable through social engineering or network-level attacks on administrators. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the straightforward nature of the attack vector suggests practical exploit development is feasible.

Remediation

Immediate patching to version 6.6.1 or later is the definitive remediation. Users should prioritize this update on all Pi-hole FTL instances. As an interim mitigation, restrict administrative web interface access to trusted IP addresses or behind a VPN, and minimize the window of time the web interface remains open. Implement network segmentation to limit lateral movement if a session is compromised. Monitor for suspicious session activity or unexpected configuration changes.

Patch guidance

Update Pi-hole FTL to version 6.6.1 or later. Most users running Pi-hole with automatic updates enabled will receive this patch automatically. For manual updates, use the Pi-hole web interface update mechanism or SSH into the system and run the update command appropriate to your installation method. Verify the installed version post-update by checking the About page in the web interface or running 'pihole -v' from the command line. Test basic DNS filtering functionality after patching to confirm proper operation.

Detection guidance

Monitor for multiple concurrent HTTP requests to the Pi-hole web interface from the same source, particularly those with unusual timing or request patterns that might indicate race condition exploitation attempts. Review web server access logs for failed authentication attempts followed by successful sessions, or for session IDs that appear to be shared across different IP addresses or user agents. Implement network monitoring to detect attempts to access the admin interface from unexpected sources. Log aggregation systems should flag rapid session state changes or administrative actions taken outside normal maintenance windows.

Why prioritize this

This vulnerability merits immediate attention despite not being in active exploitation. The combination of network accessibility, high impact (full administrative compromise), and the relatively low complexity of exploitation makes it an attractive target for attackers. Pi-hole instances often sit on home networks and small business networks with limited additional security controls, amplifying the risk. The requirement for user interaction reduces the automated worm-spreading potential but does not reduce the risk for targeted attacks against administrators or social engineering campaigns.

Risk score, explained

The CVSS 8.8 HIGH score reflects the vulnerability's ability to compromise confidentiality, integrity, and availability (C:H/I:H/A:H) over the network without requiring authentication. The score appropriately weighs the user interaction requirement, which prevents fully autonomous exploitation. For defenders, this translates to a vulnerability that demands prompt patching but allows a brief window for coordinated remediation efforts before widespread weaponization is likely.

Frequently asked questions