CVE-2026-50130 Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`
An attacker with pihole user access can escalate to root by replacing the logrotate configuration file, which is then executed with root privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50130?
CVE-2026-50130 is a high-severity vulnerability in pi-hole, published on 14 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.
Weakness: CWE-282
Which versions are affected by CVE-2026-50130?
It affects 1 product.
Products include Pi-Hole Pi-Hole.
How do I fix CVE-2026-50130?
No fix has been published for CVE-2026-50130 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-50130 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50130 exists.
Other vulnerabilities in pi-hole
- CVE-2020-8816 Pi-Hole AdminLTE Remote Code Execution
- CVE-2025-34087 Pi-Hole AdminLTE Whitelist (now 'Web Allowlist') Remote Command Execution
- CVE-2020-11108 File upload in n/a
- CVE-2019-13051 Pi-Hole 4.3 allows Command Injection.
- CVE-2024-34361 Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
Sources
Also known as GHSA-h8w9-qx2v-wrww.