pi-hole

Update docker.io/pihole/pihole Docker tag to v2026.10.0

On all three nodes I upgraded Pi-hole successfully by means of fully automated Watchtower Docker container update with dependency update facilitated by Mend's Renovate Bot.

Package	Update	Change
docker.io/pihole/pihole	minor	`2026.09.0` → `2026.10.0`

Release Notes

pi-hole/docker-pi-hole (docker.io/pihole/pihole)

`v2026.10.0`

Compare Source

What's Changed (Docker Specific)

Trust Core and Web repositories for the pihole user (GHSA-xch2-4qxw-g5vj) by @PromoFaux in #2079
fix: fail closed on FTL and GitHub release downloads by @lbellows in #2069
Do not xtrace the Docker secret web password by @lbellows in #2077
build(deps): Bump alpine from 3.24.1 to 3.24.2 in /src by @dependabot in #2078

Full Changelog: https://github.com/pi-hole/docker-pi-hole/compare/2026.09.0...2026.10.0

Security Fixes

This release includes fixes for 17 security advisories across FTL, Web and Core.

pi-hole/FTL/security/advisories/GHSA-2h7g-g549-hf74 — Authenticated File Read and Fix Bypass (High) reported by abdoghazy2015, Jgarcg40
pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398 — Local privilege escalation from pihole user to root via CVE-2026-41489 fix bypass (High) reported by abdoghazy2015
pi-hole/pi-hole/security/advisories/GHSA-j8vh-6fp9-cjcx — Local privilege escalation through pihole-FTL ambient CAP_CHOWN capability (High) reported by keithlinneman
pi-hole/pi-hole/security/advisories/GHSA-mff6-cjc4-5wq9 — Pi-hole: gravity.sh chowns arbitrary directory to pihole via files.gravity config path (root LPE) (High) reported by KimiSecurityTeam, keithlinneman, Pedromdsn
pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj — arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink (High) reported by keithlinneman, KimiSecurityTeam
pi-hole/FTL/security/advisories/GHSA-667h-gpmh-7gxc — Authenticated Arbitrary File Read via file:// Blocklists in Pi-hole (FTL / Web v6) (Moderate) reported by Rakan78
pi-hole/FTL/security/advisories/GHSA-8fc6-q9x4-892v — Unauthenticated CHAOS/TXT DNS queries overflow pihole-FTL's shared stat buffer (DNS denial of service) (Moderate) reported by dagadjno
pi-hole/FTL/security/advisories/GHSA-v53r-4564-3449 — App-password and CLI sessions can read all admin auth secrets (Moderate) reported by Pedromdsn
pi-hole/FTL/security/advisories/GHSA-xj4x-gf2g-r6m7 — an EDNS option from one query can be applied to another client's query (Moderate) reported by 010011110
pi-hole/FTL/security/advisories/GHSA-322h-f873-hp54 — Any website can read and change a Pi-hole v6 without a password through a LAN user's browser (CORS "*" + CSRF + DNS rebinding) (Low) reported by ChrisLundquist
pi-hole/FTL/security/advisories/GHSA-9828-2f2q-2c8v — authenticated use-after-free in the domain search API during a list reload crashes the resolver (Low) reported by 010011110
pi-hole/FTL/security/advisories/GHSA-mqr7-j2p5-5495 — authenticated double free in the domain-list regex validation API crashes the resolver (Low) reported by 010011110
pi-hole/FTL/security/advisories/GHSA-v8mj-cqgw-63rj — Use-after-free of DHCP leases: DELETE /api/dhcp/leases frees a lease on a worker thread while dnsmasq's main thread prunes the same list (Low) reported by 010011110
pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6 — file:// adlist read check and curl can resolve different files (Low)
pi-hole/web/security/advisories/GHSA-3vhj-5284-xrmm — Stored XSS / HTML injection in DNS's Conditional Forwarding (Low) reported by KHr00t
pi-hole/web/security/advisories/GHSA-qfpp-28mj-pj6p — Stored XSS / HTML injection in Local DNS Records (Low) reported by KHr00t
pi-hole/web/security/advisories/GHSA-rmr4-hqc8-825f — Stored XSS in All Settings (Low) reported by KHr00t