What's Changed (Docker Specific)
- Trust Core and Web repositories for the pihole user (GHSA-xch2-4qxw-g5vj) by @PromoFaux in #2079
- fix: fail closed on FTL and GitHub release downloads by @lbellows in #2069
- Do not xtrace the Docker secret web password by @lbellows in #2077
- build(deps): Bump alpine from 3.24.1 to 3.24.2 in /src by @dependabot in #2078
Full Changelog: 2026.09.0...2026.10.0
Security Fixes
This release includes fixes for 17 security advisories across FTL, Web and Core.
- pi-hole/FTL/security/advisories/GHSA-2h7g-g549-hf74 — Authenticated File Read and Fix Bypass (High) reported by abdoghazy2015, Jgarcg40
- pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398 — Local privilege escalation from
piholeuser to root via CVE-2026-41489 fix bypass (High) reported by abdoghazy2015 - pi-hole/pi-hole/security/advisories/GHSA-j8vh-6fp9-cjcx — Local privilege escalation through pihole-FTL ambient CAP_CHOWN capability (High) reported by keithlinneman
- pi-hole/pi-hole/security/advisories/GHSA-mff6-cjc4-5wq9 — Pi-hole: gravity.sh chowns arbitrary directory to pihole via files.gravity config path (root LPE) (High) reported by KimiSecurityTeam, keithlinneman, Pedromdsn
- pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj — arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink (High) reported by keithlinneman, KimiSecurityTeam
- pi-hole/FTL/security/advisories/GHSA-667h-gpmh-7gxc — Authenticated Arbitrary File Read via
file://Blocklists in Pi-hole (FTL / Web v6) (Moderate) reported by Rakan78 - pi-hole/FTL/security/advisories/GHSA-8fc6-q9x4-892v — Unauthenticated CHAOS/TXT DNS queries overflow pihole-FTL's shared stat buffer (DNS denial of service) (Moderate) reported by dagadjno
- pi-hole/FTL/security/advisories/GHSA-v53r-4564-3449 — App-password and CLI sessions can read all admin auth secrets (Moderate) reported by Pedromdsn
- pi-hole/FTL/security/advisories/GHSA-xj4x-gf2g-r6m7 — an EDNS option from one query can be applied to another client's query (Moderate) reported by 010011110
- pi-hole/FTL/security/advisories/GHSA-322h-f873-hp54 — Any website can read and change a Pi-hole v6 without a password through a LAN user's browser (CORS "*" + CSRF + DNS rebinding) (Low) reported by ChrisLundquist
- pi-hole/FTL/security/advisories/GHSA-9828-2f2q-2c8v — authenticated use-after-free in the domain search API during a list reload crashes the resolver (Low) reported by 010011110
- pi-hole/FTL/security/advisories/GHSA-mqr7-j2p5-5495 — authenticated double free in the domain-list regex validation API crashes the resolver (Low) reported by 010011110
- pi-hole/FTL/security/advisories/GHSA-v8mj-cqgw-63rj — Use-after-free of DHCP leases: DELETE /api/dhcp/leases frees a lease on a worker thread while dnsmasq's main thread prunes the same list (Low) reported by 010011110
- pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6 — file:// adlist read check and curl can resolve different files (Low)
- pi-hole/web/security/advisories/GHSA-3vhj-5284-xrmm — Stored XSS / HTML injection in DNS's Conditional Forwarding (Low) reported by KHr00t
- pi-hole/web/security/advisories/GHSA-qfpp-28mj-pj6p — Stored XSS / HTML injection in Local DNS Records (Low) reported by KHr00t
- pi-hole/web/security/advisories/GHSA-rmr4-hqc8-825f — Stored XSS in All Settings (Low) reported by KHr00t
Component Releases
Release notes for the components included in this image: