Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Pi-hole bug bounty programs

pi-hole.net Updated

Pi-hole runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Pi-hole runs.

  • Pi-hole / FTL

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 5 excluded.

  • https://pi-hole.net

    Web

  • Blocklist and gravity handling: fetching remote lists, parsing them and building the blocking database from data whoever publishes the list controls

    Products and areas

  • Conditional forwarding and the upstream resolver paths, including DoH or DoT where an installation adds it

    Products and areas

  • Docker packaging and the container's default configuration, the way a large share of installations actually run

    Products and areas

  • FTL, the C daemon: the forked dnsmasq core, DNS query handling, DHCP handling and the blocking logic layered on top

    Products and areas

  • The admin web interface and its templates, where query data collected from the network is rendered back to an operator

    Products and areas

  • The DHCP server function, which Pi-hole commonly runs in place of the router's own

    Products and areas

  • The installer and update scripts, which run as root and fetch code over the network

    Products and areas

  • The organisation's policy welcomes all responsible disclosures and names one email address for them. It draws no boundary beyond ruling out public issues, so the whole product is in

    Products and areas

  • The query database and statistics engine, including everything written to and read back from long-term storage

    Products and areas

  • The web API in full, covering authentication, session handling, every endpoint and every setting a caller can change

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A user deliberately exposing the admin interface to the internet, absent a defect in the interface itself

  • Blocklist content, including a list that blocks or fails to block a given domain

  • Public GitHub issues filed as security reports, which the policy rules out by name

  • Third-party plugins and community scripts that are not part of the Pi-hole repositories

  • Unmodified upstream dnsmasq code, which belongs to that project's own maintainer and reporting channel

Recent changes

Reward and scope changes across every Pi-hole program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Pi-hole products, from the NVD.

Search NVD
  • CVE-2026-50130 High

    Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firsta

  • CVE-2026-39849 High

    Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbitrary directives into the generated dnsmasq configuration file. On installations with no admin password set (the default for many deployments

  • CVE-2026-35520 High

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.leaseTime). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline charact

  • CVE-2026-35521 High

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ulti

  • CVE-2026-35517 High

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline cha

  • CVE-2026-35518 High

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns.cnameRecords). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline cha

  • CVE-2026-35519 High

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline charact

  • CVE-2026-35491 Medium

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature (webserver.api.cli_pw) that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config correctly blocks CLI sessions from mutating configuration, /api/teleporter allowed Teleporter import

About this page

This page gathers every public program listed under pi-hole.net: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.