Pterodactyl vulnerabilities
28 CVEs and advisories name Pterodactyl as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-86177Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
- CVE-2026-61617Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
- CVE-2026-52856Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
- CVE-2026-52855Wings exposes node configuration secrets through egg configuration-file templating
- CVE-2026-52857Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
- CVE-2026-61609Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
- CVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
- CVE-2026-35202Pterodactyl has a database resource limit bypass via race condition in Client API
- CVE-2026-26016Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
- CVE-2026-21696Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered
- CVE-2025-69199Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances
- CVE-2025-69198Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
- CVE-2025-69197Pterodactyl TOTPs can be reused during validity window
- CVE-2025-68954Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
- CVE-2025-49132Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
- CVE-2024-49762Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
- CVE-2024-34066Arbitrary File Write/Read in Pterodactyl wings
- CVE-2024-34067Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel
- CVE-2024-34068Server-side Request Forgery during remote file pull in Pterodactyl wings
- CVE-2024-27102Improper isolation of server file access in github.com/pterodactyl/wings
- CVE-2023-32080Wings vulnerable to escape to host from installation container
- CVE-2023-25168Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings
- CVE-2023-25152Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
- CVE-2021-41273Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
- CVE-2021-41176logout CSRF in Pterodactyl Panel
- CVE-2021-41129Authentication bypass in Pterodactyl
- CVE-2021-32699Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
- CVE-2019-1020002Pterodactyl before 0.7.14 with 2FA allows credential sniffing.