# pterodactyl/panel (Packagist) vulnerabilities

14 known vulnerabilities (2 critical, 4 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/pterodactyl/panel

## Advisories (14)

### [CVE-2026-61609](https://cve.now/CVE-2026-61609): Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

- Severity: High 7.5
- Published: Jul 28, 2026
- Affected: from 1.7.0, fixed in 1.13.0.

### [CVE-2026-54593](https://cve.now/CVE-2026-54593): Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted \`file.create\` permissions

- Severity: High 8.1
- Published: Jul 28, 2026
- Affected: fixed in 1.12.3.

### [CVE-2026-35202](https://cve.now/CVE-2026-35202): Pterodactyl has a database resource limit bypass via race condition in Client API

- Severity: Low 2.3
- Published: Jun 2, 2026
- Affected: fixed in 1.12.3.

### [CVE-2026-26016](https://cve.now/CVE-2026-26016): Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

- Severity: Critical 9.2
- Published: Feb 19, 2026
- Affected: fixed in 1.12.1.

### [CVE-2025-69198](https://cve.now/CVE-2025-69198): Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

- Severity: Medium 6.0
- Published: Jan 19, 2026
- Affected: fixed in 1.12.0.

### [CVE-2025-69197](https://cve.now/CVE-2025-69197): Pterodactyl TOTPs can be reused during validity window

- Severity: Medium 6.5
- Published: Jan 6, 2026
- Affected: fixed in 1.12.0.

### [CVE-2025-68954](https://cve.now/CVE-2025-68954): Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

- Severity: High 7.5
- Published: Jan 6, 2026
- Affected: fixed in 1.12.0.

### [CVE-2025-49132](https://cve.now/CVE-2025-49132): Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

- Severity: Critical 10.0
- Published: Jun 20, 2025
- Affected: fixed in 1.11.11.

### [CVE-2024-49762](https://cve.now/CVE-2024-49762): Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

- Severity: Medium 4.6
- Published: Oct 24, 2024
- Affected: fixed in 1.11.8.

### [CVE-2024-34067](https://cve.now/CVE-2024-34067): Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel

- Severity: Medium 6.1
- Published: May 3, 2024
- Affected: fixed in 1.11.6.

### [CVE-2021-41273](https://cve.now/CVE-2021-41273): Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys

- Severity: Medium 4.3
- Published: Nov 17, 2021
- Affected: fixed in 1.6.6.

### [CVE-2021-41176](https://cve.now/CVE-2021-41176): logout CSRF in Pterodactyl Panel

- Severity: Medium 4.3
- Published: Oct 25, 2021
- Affected: from 1.0.0, fixed in 1.6.3.

### [CVE-2021-41129](https://cve.now/CVE-2021-41129): Authentication bypass in Pterodactyl

- Severity: High 8.1
- Published: Oct 6, 2021
- Affected: from 1.0.0, fixed in 1.6.2.

### [CVE-2019-1020002](https://cve.now/CVE-2019-1020002): Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

- Severity: Unrated
- Published: Jul 29, 2019
- Affected: fixed in 0.7.14.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/pterodactyl/panel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.