CVE-2026-44693: Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer

Synopsis

A race condition in Pi-hole FTL's HTTP session management subsystem allows an unauthenticated remote attacker to hijack active administrator sessions. The vulnerability is reachable over the network with no credentials required, but the attacker must trick a logged-in user into visiting a crafted page or triggering a timed request. Successful exploitation gives the attacker full read, write, and denial-of-service capability over the Pi-hole instance. HarborGuard is tracking the upstream advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Pi-hole FTL web interface over the network to deliver the exploit.

• AuthenticationNot required

  No credentials are needed; the attacker targets the session buffer of an already-authenticated victim rather than authenticating themselves.

• Victim interactionRequired

  A logged-in Pi-hole administrator must be socially engineered into visiting a crafted page or otherwise triggering a timed HTTP request during an active session.

• Attack complexityDetail

  Although no special configuration is needed to reach the endpoint, the race condition requires the attacker to win a timing window against the shared global session buffer, which may require repeated attempts.

Blast Radius

• Reads the victim's active session token, exposing full administrative access to the Pi-hole dashboard including DNS query logs and allow/blocklists.
• Modifies DNS blocklist and allowlist rules, enabling the attacker to unblock malicious domains or block legitimate ones across the network.
• Alters upstream DNS resolver configuration, redirecting all DNS queries on the network to an attacker-controlled resolver.
• Crashes or restarts the FTL service, disrupting DNS resolution for every client on the network segment relying on Pi-hole.