Pi-hole

Version2026.05.0

Source codePublic

Compatible withumbrelOS 0.5 or later

Instead of browser plugins or other software on each computer, install Pi-hole® on your Umbrel and your entire network is protected. Network-level blocking allows you to block ads in non-traditional places such as mobile apps and smart TVs, regardless of hardware or OS. Since advertisements are blocked before they are downloaded, network performance is improved and will feel faster.

In addition to blocking advertisements, Pi-hole® has an informative Web interface that shows stats on all the domains being queried on your network. Pi-hole® works fine with an existing DHCP server, but you can use Pi-hole®'s to keep your network management in one place.

Pi-hole® and the Pi-hole® logo are registered trademarks of Pi-hole. Umbrel is not sponsored, endorsed by, or associated with Pi-hole®.

What's new

Version 2026.05.0+3 days ago

⚠️ If you have set up your router to use Pi-hole as its only DNS server, umbrelOS may be unable to resolve domain names during the update, preventing it from downloading the update files. To avoid issues, temporarily set a backup DNS server (e.g., 1.1.1.1) on your router before updating— or configure a permanent fallback DNS to prevent future issues.

This release includes FTL v6.6.2, which imports upstream dnsmasq security fixes for all publicly disclosed CVEs against the dnsmasq 2.92/2.93 line.

No Pi-hole configuration or API changes are expected; users should see no observable behavior change beyond the security fixes.

Full release notes can be found at https://github.com/pi-hole/docker-pi-hole/releases/tag/2026.05.0

Version 2026.04.1+2 weeks ago

⚠️ If you have set up your router to use Pi-hole as its only DNS server, umbrelOS may be unable to resolve domain names during the update, preventing it from downloading the update files. To avoid issues, temporarily set a backup DNS server (e.g., 1.1.1.1) on your router before updating— or configure a permanent fallback DNS to prevent future issues.

This release includes bug fixes and stability improvements:

🚨 Fixed two security vulnerabilities in FTL (GHSA-6w8x-p785-6pm4 and GHSA-9cqv-839p-gpq2)
Fixed thread-safety issues that could cause crashes under concurrent API load
Fixed a rare race condition in API handlers
Fixed a device lookup issue when MAC-based name resolution is disabled
Improved support for punycode domains rejected by IDNA2008
Improved shutdown diagnostics
Fixed ownership permissions for directories
Fixed permission handling for gravity-related files

Full release notes can be found at https://github.com/pi-hole/docker-pi-hole/releases/tag/2026.04.1

Version 2026.04.0+this month

⚠️ If you have set up your router to use Pi-hole as its only DNS server, umbrelOS may be unable to resolve domain names during the update, preventing it from downloading the update files. To avoid issues, temporarily set a backup DNS server (e.g., 1.1.1.1) on your router before updating— or configure a permanent fallback DNS to prevent future issues.

This release includes several security fixes and improvements:

🚨 Fixed multiple security vulnerabilities including Remote Code Execution (RCE) via newline injection in configuration parameters
🚨 Fixed an authorization bypass that allowed CLI API sessions to import Teleporter archives and modify configuration
🚨 Fixed multiple stored HTML injection and XSS vulnerabilities in the web interface
🚨 Fixed a local privilege escalation vulnerability
Fixed client count inflation for rate-limited queries
Fixed overTime data when database import is disabled
Added new option for controlling name resolution via MAC address
Improved Content Security Policy with additional hardening
Fixed an issue where FTL could restart while gravity update was still running

Full release notes can be found at https://github.com/pi-hole/docker-pi-hole/releases/tag/2026.04.0

Version 2026.02.0+2 months ago

⚠️ If you have set up your router to use Pi-hole as its only DNS server, umbrelOS may be unable to resolve domain names during the update, preventing it from downloading the update files. To avoid issues, temporarily set a backup DNS server (e.g., 1.1.1.1) on your router before updating— or configure a permanent fallback DNS to prevent future issues.

This release includes several improvements and bug fixes:

Updated embedded SQLite to version 3.51.2
Updated embedded dnsmasq to version 2.92rc1
Improved gravity domain validation processing speed
Enhanced query log loading performance
Reduced startup delay and optimized low-memory hardware performance
Fixed security vulnerabilities in the web interface
Improved network overview with MAC and hostname information from DHCP leases
Added option to hide network connection errors
Hardened default Content Security Policy

Full release notes can be found at https://github.com/pi-hole/docker-pi-hole/releases/tag/2026.02.0

Version 2025.11.1+5 months ago

⚠️ If you have set up your router to use Pi-hole as its only DNS server, umbrelOS may be unable to resolve domain names during the update, preventing it from downloading the update files. To avoid issues, temporarily set a backup DNS server (e.g., 1.1.1.1) on your router before updating— or configure a permanent fallback DNS to prevent future issues.

This release includes several improvements and bug fixes:

Improved FTL startup detection and log tailing
Added RISCV architecture support back
Updated DNS listening mode to 'ALL' in the example docker-compose.yml
Added instructions for excluding Pi-hole from Watchtower updates

Full release notes can be found at https://github.com/pi-hole/docker-pi-hole/releases/tag/2025.11.1

Related