# cve.now: Pterodactyl

The newest entries naming Pterodactyl as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-86177](https://cve.now/CVE-2026-86177.md): Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks (CVSS 8.7)
- [CVE-2026-61617](https://cve.now/CVE-2026-61617.md): Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion (CVSS 7.7)
- [CVE-2026-52856](https://cve.now/CVE-2026-52856.md): Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service (CVSS 7.5)
- [CVE-2026-52855](https://cve.now/CVE-2026-52855.md): Wings exposes node configuration secrets through egg configuration-file templating (CVSS 9.9)
- [CVE-2026-52857](https://cve.now/CVE-2026-52857.md): Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM (CVSS 5.5)
- [CVE-2026-61609](https://cve.now/CVE-2026-61609.md): Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) (CVSS 7.5)
- [CVE-2026-54593](https://cve.now/CVE-2026-54593.md): Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted \`file.create\` permissions (CVSS 8.1)
- [CVE-2026-35202](https://cve.now/CVE-2026-35202.md): Pterodactyl has a database resource limit bypass via race condition in Client API (CVSS 2.3)
- [CVE-2026-26016](https://cve.now/CVE-2026-26016.md): Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization (CVSS 9.2)
- [CVE-2026-21696](https://cve.now/CVE-2026-21696.md): Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered (CVSS 8.3)
- [CVE-2025-69199](https://cve.now/CVE-2025-69199.md): Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances (CVSS 8.3)
- [CVE-2025-69198](https://cve.now/CVE-2025-69198.md): Pterodactyl's improper resource locking allows raced queries to create more resources than alloted (CVSS 6.0)
- [CVE-2025-69197](https://cve.now/CVE-2025-69197.md): Pterodactyl TOTPs can be reused during validity window (CVSS 6.5)
- [CVE-2025-68954](https://cve.now/CVE-2025-68954.md): Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced (CVSS 7.5)
- [CVE-2025-49132](https://cve.now/CVE-2025-49132.md): Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution (CVSS 10.0)
- [CVE-2024-49762](https://cve.now/CVE-2024-49762.md): Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled (CVSS 4.6)
- [CVE-2024-34066](https://cve.now/CVE-2024-34066.md): Arbitrary File Write/Read in Pterodactyl wings (CVSS 8.5)
- [CVE-2024-34067](https://cve.now/CVE-2024-34067.md): Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel (CVSS 6.1)
- [CVE-2024-34068](https://cve.now/CVE-2024-34068.md): Server-side Request Forgery during remote file pull in Pterodactyl wings (CVSS 6.4)
- [CVE-2024-27102](https://cve.now/CVE-2024-27102.md): Improper isolation of server file access in github.com/pterodactyl/wings (CVSS 10.0)
- [CVE-2023-32080](https://cve.now/CVE-2023-32080.md): Wings vulnerable to escape to host from installation container (CVSS 9.1)
- [CVE-2023-25168](https://cve.now/CVE-2023-25168.md): Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings (CVSS 9.6)
- [CVE-2023-25152](https://cve.now/CVE-2023-25152.md): Symbolic Link (Symlink) Following in github.com/pterodactyl/wings (CVSS 8.4)
- [CVE-2021-41273](https://cve.now/CVE-2021-41273.md): Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys (CVSS 4.3)
- [CVE-2021-41176](https://cve.now/CVE-2021-41176.md): logout CSRF in Pterodactyl Panel (CVSS 4.3)
- [CVE-2021-41129](https://cve.now/CVE-2021-41129.md): Authentication bypass in Pterodactyl (CVSS 8.1)
- [CVE-2021-32699](https://cve.now/CVE-2021-32699.md): Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings (CVSS 6.5)
- [CVE-2019-1020002](https://cve.now/CVE-2019-1020002.md): Pterodactyl before 0.7.14 with 2FA allows credential sniffing. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pterodactyl
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.