CVE-2026-119336 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119336?
CVE-2026-119336 is a high-severity vulnerability in pi-hole, published on 30 Oct 2026.
Official description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
Which versions are affected by CVE-2026-119336?
How do I fix CVE-2026-119336?
No fix has been published for CVE-2026-119336 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119336 being exploited?
There is no known exploitation of CVE-2026-119336 in the wild and no public exploit code.
Sources
Also known as GHSA-xch2-4qxw-g5vj.