Pi-hole 2026.10.0: 17 security fixes, clean upgrade

released
lab run
upgraded from
2026.09.0
guest
Ubuntu 26.04 VM
tested
yes, in our lab

Summary

This Docker image release bundles Pi-hole FTL v6.8, Web v6.6.1 and Core v6.5. According to the release notes, it addresses 17 security advisories across FTL, Web and Core. It also makes a few Docker-specific changes: the image no longer lets the pihole user write to the Core and Web repositories, downloads of FTL and GitHub releases now fail closed, and the Docker-secret web password is no longer exposed by shell tracing.

Breaking changes and deprecations

The release notes list none. We did not hit any in the lab.

Tested in our lab

We installed 2026.09.0 with Docker Compose, then upgraded to 2026.10.0.

  • Before: Core v6.4.3, Web v6.6, FTL v6.7.1.
  • Before the upgrade we set a local DNS record (labtest.home → 10.1.2.3) and added example.org to the allow list.
  • We ran docker compose down, changed the image tag, pulled, and ran docker compose up -d, keeping the same /etc/pihole volume.
  • After: Core v6.5, Web v6.6.1, FTL v6.8. The container became healthy in about 40 seconds.
  • The local DNS record still resolved, the allow-list entry was still there, normal lookups worked, and the web login page returned HTTP 200.
  • Our container logs only showed warnings that the NTP client can’t set the system time (the container lacks CAP_SYS_TIME). We didn’t capture the old version’s logs, so we can’t say whether these are new. They are harmless unless you want the container to set the clock.

Not tested: the individual security fixes, upgrades from older versions than 2026.09.0, and use as the network’s main DNS server (we published DNS on port 5353 for testing).

Lab log

$ docker exec pihole pihole -v
Core version is v6.4.3 (Latest: v6.5)
Web version is v6.6 (Latest: v6.6.1)
FTL version is v6.7.1 (Latest: v6.8)
$ docker compose down
 Container pihole  Removed
$ docker compose up -d
 Container pihole  Started
$ docker ps --format "{{.Image}} {{.Status}}"
pihole/pihole:2026.10.0 Up 40 seconds (healthy)
$ docker exec pihole pihole -v
Core version is v6.5 (Latest: v6.5)
Web version is v6.6.1 (Latest: v6.6.1)
FTL version is v6.8 (Latest: v6.8)
$ dig +short -p 5353 @127.0.0.1 labtest.home
10.1.2.3
$ docker exec pihole pihole-FTL --config dns.hosts
[ 10.1.2.3 labtest.home ]
$ curl -s -o /dev/null -w "%{http_code}\n" localhost:8080/admin/login
200

Reported by others

Nothing beyond the official release notes, which we did not verify. They describe 5 high, 4 moderate and 8 low severity advisories. The high ones include privilege escalation issues in Core and an authenticated file read in FTL. The moderate ones include file read via file:// blocklists and a buffer overflow in CHAOS/TXT DNS query handling.

Verdict

Upgrade now. The security fixes are the reason, and the upgrade from 2026.09.0 was uneventful in our test. Stop the container cleanly, change the tag, and start it again with your existing volume.

sources