CVE-2026-35491 Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration
Attackers with CLI API access can bypass read-only restrictions to modify Pi-hole configuration via Teleporter imports.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35491?
CVE-2026-35491 is a medium-severity missing authorization vulnerability in pi-hole FTL, published on 7 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter imports for CLI sessions, enabling a CLI-scoped session to overwrite configuration via a Teleporter archive (authorization bypass). This vulnerability is fixed in 6.6.
Weakness: CWE-863
Which versions are affected by CVE-2026-35491?
It affects 1 product.
Products include Pi-Hole Ftldns.
How do I fix CVE-2026-35491?
No fix has been published for CVE-2026-35491 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-35491 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35491 exists.
Other vulnerabilities in pi-hole FTL
- CVE-2026-35517 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection
- CVE-2026-35518 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection
- CVE-2026-35519 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection
- CVE-2026-35520 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection
- CVE-2026-35521 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection
Sources
Also known as GHSA-r7g8-3fj7-m5qq.