CVE-2026-50130 HIGH

CVE-2026-50130: Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

Vendor Pi-Hole

Product pi-hole

Weakness CWE-282

Published July 14, 2026

Last update July 14, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.

Key dates

02Disclosure timeline

July 14, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-50130 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/282.html AskarLabs — CWE-282 write-up Improper Ownership Management

Related vulnerabilities

CVE-2026-50130: Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`

01Description

02Disclosure timeline

03References

04Related CVE