CVE-2026-26953: pi-hole web · Improper Input Validation
Affects pi-hole webSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium : upgrade to 6.4.1 when convenient.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 6.4.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 19 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Upgrade pi-hole web to 6.4.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| pi-holeweb | Affected
| Fixed in
|
AI-suggested
1. Upgrade all Pi-hole installations to version 6.4.1 or later, where this vulnerability is fixed. 2. Enforce strong authentication and access controls to limit the number of users with admin credentials, reducing the risk of insider exploitation. 3. Monitor and audit admin interface access logs for suspicious activity, especially unusual X-Forwarded-For header values or repeated access to the active sessions page. 4. Consider implementing additional input validation or sanitization on proxy or web server layers to filter out malicious header values before they reach Pi-hole. 5. Educate administrators about the risk of this vulnerability and encourage cautious review of active sessions data. 6. If upgrading immediately is not possible, restrict network access to the Pi-hole admin interface to trusted IPs and VPNs to reduce exposure. 7. Regularly review and apply security patches for Pi-hole and related infrastructure components.
Description
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The rowCallback function contains the value data.x_forwarded_for, which is directly concatenated into an HTML string and inserted into the DOM using jQuery’s .html() method. This method interprets the content as HTML, which means that any HTML tags present in the value will be parsed and rendered by the browser. An attacker can use common tools such as curl, wget, Python requests, Burp Suite, or even JavaScript fetch() to send an authentication request with an X-Forwarded-For header that contains malicious HTML code instead of a legitimate IP address. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited to pure HTML injection without the ability to execute scripts. This issue has been fixed in version 6.4.1.