CVE-2021-29449mediumCWE-269

CVE-2021-29449: medium-severity vulnerability in pi-hole

Multiple Privilege Escalation Vulnerabilities Pihole

Published · Updated

Follow this CVE+ Monitor pi-hole

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 6.3epss 1.8%
from disclosure to weapon6 days
Published on NVDApr 14
metasploit+6d
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were discovered in version 5.2.4 of Pi-hole core. See the referenced GitHub security advisory for details.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected products
pi-hole · pi-hole
Related CVEs — pi-hole

In the same product, most dangerous first.

CVE-2024-34361HIGHPi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)EPSS 2.8%CVE-2024-28247HIGHPihole Authenticated Arbitrary File Read with root privilegesEPSS 1.4%CVE-2026-119334LOWPi-hole: file:// adlist read check and curl can resolve different filesEPSS 0.3%CVE-2026-50130HIGHPi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`EPSS 0.3%CVE-2026-119336HIGHPi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlinkEPSS 0.2%CVE-2026-119335HIGHPi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypassEPSS 0.2%